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SECTION I 


SUMMARY 


A. PURPOSE, SCOPE, AND APPROACH 

This report discusses the technology and safety related to the 
implementation of an Automated Mixed Traffic Vehicle (AMTV) system. 

System concepts and technology status are reviewed and areas where 
further development is needed are identified. Failure and hazard modes 
are also analyzed and methods for prevention are suggested. The results 
are intended as a guide for further efforts in AMTV system development for 
both near-term and long-term applications. 

The AMTV systems discussed include a low speed system, and a 
hybrid system which can operate at the low speed and at a higher speed 
within a protected right-of-way. The low speed system is a candidate for 
a near-term demonstration and can be used in pedestrian malls, large 
campuses emd recreational parks. The hybrid system may have application, 
after further development, on urban streets, in airports or in other 
situations where longer distances may be involved . Examples are given 
in Section II, which describe a shuttle service between two shopping 
centers separated by many city blocks, and a tram- type system in a 
pedestr^ian mall. 

The' remainder of the study was conducted using the following 
i! approac^i The physical elements of an AMTV system, both moving and 
stationary, were first described in terms of system requirements and sub- 
systtOT specifications (Section III). Technology status was then evaluated 
and required developments were identified within this framework (Section 
IV). Based on the AMTV physical elements and operating concepts, a 
comprehensive safety analysis was conducted to examine potential hazards 
caused by hardware failures and by events unrelated to hardware failure. 
Corrective and preventive actions in terms of design modifications 
or operatial procedures were suggested (Section V). 


B. MAJOR FINDINGS 
1 . Initial Demonstration 

Straightforward development using current technology will make it 
possible to demonstrate a low speed AMTV system in three to five years. 

With a prudent, fail-safe design, and appropriate right-of-way protection, 
the AMTV system can operate safely in an environment containing pedestrians. 
An initial demonstration should restrict the mixed-traffic environment 
in order to ensure safety during the learning period . 

Work needed to implement the demonstration would Include the 
following: 
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(1) Optical headway sensors to provide better frontal coverage, 
quicker response, and the added capability of sensing in 
the direction of a turn. 

(2) Bumper switches to provide both backup protection against 
collision, and a smooth, compliant surface that would minimize 
the chance of injury. Such a bumper switch should extend 
around the sides of the vehicle. 

(3) Design of a suitable vehicle matched to the application, 
and where possible, using existing automated guideway tech- 
nology. 

(4) Control logic improvements to provide flexibility and added 
capability. 

Roadside equipment may also be needed for system check-out and 
automatic scheduling control. The use of roadside sensors for control at 
crossing points should also be considered. 

Further work is needed to ensure safety, including: 

(1) A review of the AMTV system design to ensure hardware relia- 
bility and to apply fail-safe design principles to all vital 
guidance and control subsystems. 

(2) Development of means to prevent the AMTV from moving premature- 
ly vdiile passengers are boarding; perhaps by an interlocking 
door mechanism. 

(3) Development of effective procedures for route surveillance, 
system checkout, fault recovery, and maintenance. 

(4) Consideration of the effect of weather (rain, mud, ice and 
snow) on system operation. 

(5) Development of a clear definition of right of way and passenger 
access . 

(6) Development of procedures to inform the public about the char- 
acteristics of the AMTV. 

2. Urban Application 

Subsequent to an initial demonstration, a hybrid AMTV system 
could be developed for applications Involving longer distances. This 
system would consist of low-speed route sections for passenger pick-up and 
delivery, and high-speed route sections for longer-dlstance connection 
between the low-speed sections. On a low-speed section, the AMTV would 
behave like the initial demonstration system mentioned above. On a 
high-speed section, however, means must be provided to separate the AMTV 
pathway from pedestrians and other vehicles because of the longer stopping 
distance. It is not accurate to refer to this pathway isolation as 
a guideway, in the sense that it is a track that steers the vehicle. 
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since the guidance and headway protection will continue to be electronic . 
Instead, we refer to it as a semi-guide way , because of the similarity 
to a true guideway, and because the AMTV would not require a continuous, 
unbroken, grade-separated right-of-way. At traffic intersections the 
AMTV could cross either using grade separations or at-grade using traffic 
signals and barriers coupled to the AMTV control system. 

Initially, pathway protection can be accomplished by means of 
physical barriers such as fences and curbs. However, after public aware- 
ness of the system characteristics is developed , the needed pathway 
assurance may well be met by the use of accepted rules, like those 
governing a bikeway, together with expected advances in sensor technology. 
This extension would permit future use of the pathway by other vehicles. 

A 20 mph AMTV operating in an unrestricted mixed-traffic environment is 
not felt to be reasonable in the near future; research leading to new 
sensing technology must come first. 

The low-speed section and high-speed section can be considered as 
modular functional elements that may be combined in various ways to 
configure urban applications with varying geometry. The underlying 
technology can be discussed by examining AMTV operation on a typical 
low-speed section and on a typical high-speed section, together with some 
consideration of the interconnection. While much of the technology 
developed for the initial demonstration can be extended for use 
in a hybrid system, still further development and new system concepts 
are needed for high-speed operation. 

Although determination of the best speed for each mode must await 
further experience, the values selected for initial study are 7 mph 
for the low speed , eind 20 mph for the high speed . 

A long-range headway sensor must be developed for 20-mph operation, 
having a sensing range of 125 feet; the distance required to stop a 
20-mph vehicle with moderate deceleration. Reliable detection of other 
AMTV*s and automobiles at this distance is achievable by modification 
of the present type of optical headway sensors. This approach, however, 
does not ensure timely detection of smaller , dark targets due to limita- 
tions on light source power. Based on the expected capability of such a 
long-range sensor, a reasonable collision avoidance philosophy for an 
AMTV operating at 20-mph in a semi-guideway is to perform a routine 
programmed low-deceleration stop for another AMTV or an automobile, and 
to use special control logic combined with fast braking to stop for 
pedestrians or smaller-size obstructions which have violated the guide- 
way barriers , and are not detected at 125 feet . Roadside sensors to 
detect guideway violation and signal a slower speed to the AMTV should 
also receive attention. 

In the long-term, after community familiarity with the AMTV is 
established , crossing of streets with other vehicular traffic will 
become possible under appropriate conditions, using coupled traffic 
signal control or stop signs. When an AMTV must make a turn it must 
interact with the signals at the intersection; therefore, development 
of an appropriate signaling procedure will be necessary. Another valu- 
able precaution will be a stationary sensor system capable of detecting 
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a potentially dangerous vehicle at the intersection (such as a car 
about to run a red light) and signaling the AMTV to stop until the 
danger passes. 


C. RECOMMENDATIONS 

A list of items which must be developed for ? > initial demonstra- 
tion, and others for a longer-term urban application are summarized 
in Table 4-1. 

To ensure safe and smooth introduction of an AMTV system into pub- 
lic service, the system must be mature in design and free of defects. 

For this reason, any AMTV system design must be tested in a controlled 
environment before it is committed to public service. Reduction of 
accident risk, the elimination of bugs and the implementation of desir- 
able design changes are important steps which should be taken before 
introducing the new technology to the public. In addition, the use of 
attendants for insuring safe and reliable operation during the initial 
learning phase of an AMTV demonstration should not be overlooked. 

The attendants should not be perceived as drivers, and perhaps do not 
need to be seen as uniformed employees by the public. They could be 
positioned either in the vehicle or at strategic roadside locations, and 
could perform the safety backup function with an unobtrusive box having 
a "stop" command button. They might also assist with fault recovery, 
using a key - activated manual control box. AMTV need not have a 

conventional automotive driver's station. 
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SECTION II 
INTRODUCTION 


A. PURPOSE 

The purpose of this report is to review the technology used in an 
Automated Mixed Traffic Vehicle (AMTV) system, to identify areas where 
further development is either required or desirable, and to conduct a 
safety analysis of an AMTV system. In both parts of the report the goal 
was to develop recommendations which could act as a guide for further 
development of the AMTV concept. The report addresses the problem of 
developing an AMTV capable of operating in an environment containing 
both pedestrians and vehicular traffic. Attainment of true mixed traf- 
fic capability is assumed to be the long-term goal, but it is recognized 
that an initial demonstration must be in a more restricted environment. 


B. BACKGROUND 

The AMTV concept has been described in an earlier paper (Ref. 1). 
Basically, it offers a cost-effective alternative to conventional busses 
or other transportation modes for many applications requiring frequent, 
low speed service, since both the cost for a driver on each vehicle and 
the large Investment required for exclusive guideway construction can be 
avoided . 

A feasibility demonstration of an AMTV, using what was basically a 
breadboard vehicle was conducted at JPL during early 1976. Results from, 
this experiment are reported in Reference 1 . Data gen'prated by the JPL 
vehicle and experiment form a baseline for developing the technology and 
hardware sections of this report. The experiment used a wire- following 
steering system patterned after work of Fenton and Olson at Ohio State 
university (Refs. 2 and 3). Similar techniques have been used by a 
number of investigators, and reliable speeds of 50 mph have been demon- 
strated (Refs. 4 and 5). The sensors used for collision avoidance were 
developed at JPL, and were derived from earlier work on sensing for 
remote manipulation applications (Refs. 6 and 7). 

Although the JPL vehicle is a small electric tram, any type of 
vehicle could be incorporated into a future AMTV system, with the size 
and type of vehicle being determined' by the service requirements of the 
specific application. A number of guideway systems employing automated 
vehicles have recently been put into service. Requirements of these 
vehicles are quite similar to those of an AMTV, except for the provision 
for collision-avoidance (headway) sensing, and the steering mechaniza- 
tion. Experience derived from development of these guideway systems is 
therefore likely to be useful in further AMTV vehicle control develop- 
ment. Some existing guideway systems with relatively small vehicles and 
related reference documents are: 


(1) Morgan tovm (Ref. 8) 

(2) Airtrans, Dallas/Ft. Worth Airport (Ref. 9) 

(3) Seattle/Tacoma Airport Shuttle (Ref. 10) 

Another type of automated vehicle system that may offer applicable 
experience is the automated mail cart or automated warehousing vehicle 
system (Refs. 11 to 13). These' systems may employ relatively complex 
multi-loop routing controls, but are very low-speed systems without the 
headway sensing capability required for higher speed service. 


C. SCOPE OF STUDY 

The present status of the technology needed for an AMTV was examin- 
ed with respect to two stages of application, which are further described 
later in this section. The first example of an application is one which 
would be appropriate for an initial demonstration of any AMTV system, 
which might take place in 3-5 years time. The environment of the ini- 
tial system should be relatively benign and the developments needed are 
fairly straightforward. The second example of an application is a more 
challenging one, and assumes an urban CBD type of environment. Further 
developments required for such an AMTV system are identified. These 
developments are discussed primarily in terms of today’s technology, but 
some of the improvements or added capabilities represent fairly signifi- 
cant extrapolation from present experience, and may require, advances in 
the basic technology employed. These long-range developments are identi- 
fied as such in the text. 

Finally, it should be recognized that an AMTV system is a new 
concept, and its implementation will involve many non-technical questions 
during the initial period when operators, users and other traffic are 
familiarizing themselves with the new type of service. Possible ques- 
tions are; 

(1) What special traffic rules or laws need to be made for the 
AMTV, if any? 

(2) How Should operation be funded; should there be fares? 

(3) How will user preference features be taken into account? 

(4) How will passenger security be affected by '/andalism and 
pranksters? 

(5) Can passengers be allowed to assist in case of a minor prob- 
lem (such as a delivery truck parked on the route)? 

Investigation of these questions is beyond the scope of this study, 
which is primarily concerned with the technology required to implement 
an AMTV system. 
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In the safety analysis, no preconceived constraints were defined- 
However, it soon became apparent that many of the issues identified were 
not unique to the AMTV concept or the technology required to implement it, 
but are also found in existing transportation systems. Therefore, in 
order to limit the amount of data treated in the safety analysis, the 
following criteria were applied; 

( 1 ) Hazards which are common to other transportation modes or 
activities such as earthquake, or falling objects, were not 
treated in detail. 

(2) Social hazards, such as vandalism and crj^siaal attack were 
not treated . 

Identified items of this type were left in the raw data, and 
presented in Appendix A, for reference. 


D. ORGANIZATION OF REPORT 

In the remainder of this section, the two examples of AMTV applica- 
tion previously mentioned are described in more detail. 

Section III presents general requirements g;ppropriate to an AMTV 
system, independent of any specific implementation of the hardware. 
Definitions of the necessary AMTV subsystems are given. Such definitions 
are, of course, somewhat arbitrary, since the partitioning of system 
functions is never unique. It is felt, however, that the functions 
identified will be present in similar form in any AMTV system, and 
therefore the definitions presented have general validity. The subsys- 
tems of the present JPL AMTV were used as a baseline, and other elements 
were added to it to form the complete system. Following the subsystem 
definitions, performance specifications for each subsystem are identifi- 
ed to the extent now possible. These specifications are still general, 
but take into account conclusions drawn from the JPL experiment and from 
the safety emalysls presented in Section V. 

Section IV discusses development activities required to demon- 
strate 2 U 1 AMTV system. Technology developments necessary in order to 
implement a near term demonstration are recommended. Further develop- 
ments and long-range research needed for an ultimate AMTV application 
are separately identified. 

In section V, the procedures used in conducting the safety analysis 
are described, the results are interpreted, and suggestions are made for 
Implementation of the results. 

The Hazard Catalog and associated data developed in the safety 
analysis are contained in Appendix A. Similarly, a failure mode catalog 
is contained in Appendix B. The conclusions and recommendations of 
Section V were developed from the analysis of data described in Appendix- 
es A and B. 
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Brief analytical models for various elements of the AMTV are 
presented in Appendix C. 


E. AN EXAMPLE OF AN AMTV APPLICATION 

This section describes a potential AMTV application in an urban 
environment in order to provide a baseline for developing more detailed 
descriptions of the AMTV and its subsystems in subsequent sections. 

The example selected incorporates the main features which are considered 
technically feasible in a future system, and illustrates the utility of 
the AMTV from the user point of view. The capability of operating an 
AMTV in the type of environment described here is felt to be a desirable 
developmental goal . 

The application envisioned provides shopper shuttle service between 
two large shopping centers separated by a distance of one mile or more, 
as illustrated in Figyre 2-1. In addition to the shuttle function, low- 
speed service is also provided within each shopping area. For this 
application, a service with high schedule frequency is envisioned, but 
not high passenger throughput much as would be encountered in line haul 
rapid transit at rush hour. 

In each shopping center, the route passes through parking lot 
type areas as indicated in Figure 2-2, where both pedestrian and low- 
speed vehicular traffic is encountered. The vehicle travels at its low 
speed in this environment. Brief (3-4 second) stops are made either 
routinely or on demand at predetermined points to permit passengers to 
enter or leave the tram. With an appropriate (probably electric) vehicle, 
part of the route could pass through the interior of the shopping mall 
building, where the AMTV would operate in a purely pedestrian environment. 

Between the two shopping centers, the route follows a semi-guideway, 
which is an on-grade vehicle path reserved for the AMTV by fencing or 
curbing. Alternatively, distinctive lane markings, together with rules 
similar to those presently governing bikeways may be used to define the 
AMTV pathway. The vehicle cruises at high speed while in the semi-guideway. 
The guideway protection does not extend through intersections, but 
rather the AMTV is coupled to conventional traffic signals in such a way 
that safe passage across each intersection is ensured. Fixed auxilliau'y 
devices are required, to detect intrusion into the guideway by other 
vehicles or pedestrians, and also to ensure that a red traffic signal is 
not violated by vehicular cross traffic , Figure 2-3 depicts the high- 
speed route sections. Retractible barriers are shown in the figure 
to provide physical protection fbom cross traffic. Actuation of the 
barriers would be coupled with AMTV control and the traffic signals. 

They would be raised within the red period for cross traffic while 
an AMTV is crossing. Designated locations for passenger pickup are 
incorporated at approximately one block intervals. Turns would be 
made at intersections, with appropriate traffic signal coupling. 
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Figure 2-3. An Example of an AMTV Application High-Speed 

Route Section 


In general , an AMTV may have three speed modes ; the high-speed and 
low-speed modes already mentioned and an additional 1-1/2 raph mode which 
will always be incorporated as a part of the basic vehicle control system. 
Appropriate headway sensing for each speed mode is incorporated in each 
vehicle for collision avoidance. A distinctly different type of AMTV 
could be used in certain specialized applications in a purely pedestrian 
environment and would operate in the 1-1/2 mph speed mode only. 

In order to make these examples specific for the more detailed 
discussion of AMTV system design to follow, a speed of 7 mph was selected 
for the low speed mode, and 20 mph for the high speed mode. A speed 
of 7 mph, used in the JPL experiment, is a reasonable compromise, permitting 
an average speed comfortably faster than walking with moderate sensing 
requirements. A 20 mph mode would be satisfying for longer distances 
(> 1 mile), but presents considerably more difficult sensing requirements. 
However, these speeds are not fixed; their choice at this point is 
somewhat arbitrary. It will be necessary to accumulate much more experience 
with the AMTV concept before it is possible to decide on the best speeds. 

It should be further emphasized that the application illustrated 
in Figures 2-1, 2-2 and 2-3 is hypothetical, and intended only as a 
framework against which the AMTV technology can be discussed. It is 
not intended to specify what the possible AMTV applications might be. 

The different speed modes and accompanying types of route environment 
can be used in different combinations to satisfy the requirements of 
applications quite different from the example described above. For 
instance, an inter-terminal shuttle operating on an airport apron could 
utilize the 20 mph semi-guideway mode, only. The type of vehicle used 
would differ depending on the specific requirements of the application; 
a 20 mph AMTV would likely be a closed bus type vehicle, while an AMTV 
vehicle used in a route limited to a 7 mph speed may be an open tram 
configuration for faster boarding. A complete AMTV system will also 
require a vehicle storage and maintenance area which is not shown in 
the figures. For the purposes of this report, it is assumed that the 
geographic location of the AMTV system is one not subject to heavy snowfall 
or icing conditions. System operation should continue during rainy 
weather . 


F. EXAMPLE OF AN INITIAL DEMONSTRATION 

The application selected for an initial AMTV system demonstration 
must be in a considerably more restricted environment than the example 
just described. During the early phase of AMTV development, it is particu- 
larly important that the exposure of the AMTV to automobile and truck 
traffic be controlled in order to minimize the risk of accident or 
injury while operational experience is gained. It is also expected that 
an initial demonstration will be relatively modest in scope. 

Two types of environment can be suggested for an initial demonstra- 
tion: 


(1) Shuttle service in an industrial or public complex where vehicu- 
lar traffic does exist, but with controlled access. Control- 
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led vehicular access implies that interacting drivers are 
selected in some way, for example by requiring a pass to be 
shown, and that traffic is more orderly and less dense than 
would be typical of a busy urban street. An Initial applica- 
tion in an industrial environment also has the advantage that 
the interacting population can be more effectively informed 
of the utility, rules-of-the-road , and possible hazards 
of an AMTV system. 


(2) A shopping mall shuttle in a pedestrian environment, as illus- 
trated in Figure 2-4. An open court-like environment is 
envisioned, like that created by the conversion of a shopping 
center street into a mall. Alternatively, the AMTV route might 
encircle a parking lot or deliver passengers to the parking 
lot entrance, but it would not travel on streets used by the 
general public for vehicular traffic. The AMTV would interact 
only with pedestrian traffic. As shown in the figure, plant- 
ers or curbings can be used to further isolate the AMTV path. 
The degree of isolation is a safety consideration, and is a 
variable that should be expected to change as public familiar- 
ity with the system increases, and as the sensing technology 
becomes more sophisticated. 
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SECTION III 


SYSTEM AND SUBSYSTEM FUNCTIONAL REQUIREMENTS 


A, INTRODUCTION 

This section proposes system requirements, subsystem definitions 
and functional requirements for 1-1/2 mph, 7 nph» and 7/20 mph hybrid 
Automated Mixed Traffic Vehicle (AMTV) systems. These requirements 
serve as a conceptual framework within which safety can be analyzed 
and needed technology developments can be Identified. Because system 
and subsystem functions mutually interact with safety considerations, 
the requirements stated in this section reflect an iterative process 
of combining the results of the safety analysis given in Section V 
with the system requirements developed in the early p 2 u*t of this section. 

Requirements for the 7 mph AMTV are based on the experience gained 
in the development and operation of the experimental 7 mph AMTV at 
JPL and are largely carried over from that design (see Ref, 1). Other 
system requirements are developed with reference to the assumed appli- 
cations given in the previous section. 


B. SYSTEM REQUIRQIENTS 

The overall AMTV concept requires consideration of route configu- 
ration, passenger interfaces and protection, vehicle operation, regulation 
of the traffic environment, intersection handling, route condition, 
system checkout, fault recovery, storage and maintenance, and level- 
of-service control . The system requirements which integrate each of these 
aspects are briefly described below. 


1. Route Configuration 

The route for a 7/20 mph hybrid AMTV system consists of 7 mph 
Intermittent- stop and 20 mph express sections. On a 7 mph section, the 
AMTV operates at or below 7 mph picking up and discharging passengers, 
and sharing the roadway with pedestrians and slowly moving vehicles. 
Examples of a 7 mph section include large parking facilities, shopping 
malls or other pedestrian areas, bikeway type lanes on city streets, 
traffic intersections and other gaps in a semi-guideway route section. 

On a 20 mph semi-guideway section, the AMTV operates at constant speed, 
slowing as necesseury for curves, traffic signals or as it approaches 
a 7 mph section. It also slows down idien an obstacle is detected in 
the pathway and will, if necessary, come to a full stop to avoid colliding 
with it. For safe operation, the 20 mph section right-of-way requires 
fences, or curbs to separate pedestrians and vehicles from the AMTV 
path. In a similar way, 1-1/2 m|^ sections may be programmed into 
7 mph AMTV route segments, for example, at a U-turn. 
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Passenger Interfaces and Protection 


a. AMTV Boarding . Because random boarding would cause excessive 
delays, marked passenger stops would be provided in a 7 or 7/20 mph 
hybrid system. A 1-1/2 mph AMTV could operate as a moving platform, 
allowing passengers to enter or leave at any time without stopping 
the vehicle. If traffic intersections are limited to pedestrians and 
very light vehicles (bicycles, for example), a 7 mph vehicle can be 
an open type tram to permit faster boarding. 

Either 7 mfii or 7/20 mi* hybrid AMTVs will be programmed for a 
predetermined standing time at each passenger stop to allow sufficient 
time for boarding. Should boarding not be complete by the end of the 
standing time, sensors must be installed to sense the presence of passengers 
in the boarding zone and prevent the vehicle from moving off. Alternatively, 
manually operated entrance doors equipped with jamb interlock switches 
which will electrically inhibit vehicle motion until all doors are 
closed and locked may be used. In addition, passenger operated emergency 
push button switches located near the seats can be used as a back-up 
system. 


b. Capacity . There is no technical constraint on the size 
and capacity of an AMTV. Therefore, accommodations can be based on 
the expected level of service required for the particular application. 

As examples, the experimental JPL AMTV has eight seats, but a 7/20 mph 
hybrid AMTV for shuttle service between two shopping centers may well 
have 20 or 30 seats. The straightforward relationship between AMTV 
parameters and system capacity is given in Table 3-1 • Service capacity 
can be increased by increasing the capacity of each AMTV, adding more 
AMTVs to the route or by forming multi-car trains using specially designed 
tractors and trailers. 

If desirable from an application standpoint, standing passengers 
may be permitted on an AMTV if they remain clear of the boarding 
entrances. In such cases, handgrips must be provided, and vehicle 
acceleration and jerk levels must be controlled to prevent throwing 
standing passengers off balance. 

c. Passenger Protection . A 7 mph AMTV should have an enclosed 
body for protection of passengers in a side collision unless, as noted 
above, it only interacts with pedestrians and/or very light vehicles. 
However, for safety and passenger comfort, a 7/20 mph hybrid AMTV must 
have an enclosed body with manually or automatically operated quick 
opening doors. Emergency stop buttons should be provided for use by 
passengers in the event of a collision, impending collision or on-board 
emergency. A simple but reliable door mechanism should be used such 
that if the door is not securely closed, the vehicle will not move. 

While the vehicle is in motion, all doors will remain locked. 

d. Passenger Comfort . Noise levels must be kept low and vehicle 
vibrations in the horizontal, vertical and longitudinal directions 

must be kept within acceptable limits (Ref. 14). Interior layout and 
seat spacing must be arranged to permit free passenger movement during 
bearding stops. Appropriate interior lighting should be provided. 
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Table 3-1. Relationship Between AMTV System Capacity Parameters. (Values For nominal speed, stops per mile 
and vehicles per mile are assumed. Ten second passenger stops are assumed. Note that a 30 
passenger vehicle with one door would require a longer stop period, not shown). 



Nominal 

AMTV 

Sneed 

Stops 
per ml 

Average 

Speed 

Travel 
time /mi 

Vehicles 
per mi 

Headway 

Interval 

Line Capacity 
8 passenger 30 passenger 
AMTV AMTV 


mnh 


mnh 

min 


min 

nass./hr 

nass./hr 


1.5 

0 

1.5 

40 

10 

4 

120 

450 


1.5 

0 

1.5 

40 

30 

1.3 

370 

1380 


7 

15 

5.0 

12.0 

2 

6.0 

80 

300 


7 

5 

6.2 

9.7 

6 

1.6 

300 

1120 


7 

10 

5.5 

10.9 

6 

1.8 

270 

1000 


7 

15 

5.0 

12.0 

6 

2.0 

240 

900 


7 

20 

4.5 

13.2 

6 

2.2 

220 

820 


7 

15 

5.0 

12.0 

20 

0.6 

800 

3000 

o S 
wg 

20 

4 

13.9 

4.3 

1 

4.3 

110 

420 


20 

1 

18.1 

3.3 

3 

1.1 

440 

1640 

1? 

20 

2 

16.2 

3.7 

3 

1.2 

400 

1500 


20 

4 

13-9 

4.3 

3 

1.4 

340 

1290 

gw 






- 



20 

8 

10.5 

5.7 

3 

1.9 

250 

950 


20 

4 

13-9 

4.3 

10 

.43 

1120 

4190 


Maximum vehicle acceleration and jerk rates shall be within the range 
established as common practice in public transit vehicles. 


3. AMTV Operation 

a. Lateral Steering . An AMTV should track a fixed guidewire 
reliably and in a fail-safe fashion . 

b. Passenger Stops . An AMTV should come to a controlled stop 
upon passenger request. Road- fixed devices should also be available 

to command the same controlled stop. In more advanced systems, persons 
at a designated boarding area may call for service. In such a case, 
a call button either on the AMTV or at the passenger stop area could 
cause the preset stop maneuver to be executed . 

c. Headway Sensing . The AMTV must be able to sense obstacles 
in its path, such as pedestrians, vehicles or potentially damaging 
objects, and perform a controlled stop to avoid collision. 

d. Collisions with Small Objects . If the AMTV bumper contacts 
an object undetected by the headway sensors (such as a rock or 

small animal), the emergency braking system will be activated to bring 

the AMTV to a locked-wheel stop. The brakes will remain set until 

the path is cleared. Procedures for restarting the AMTV must be developed. 

e. Intersection Control . If an AMTV route passes through 
or turns at an intersection, the intersection must be equipped with 
four-way stop signs or traffic signals which are coupled with the AMTV 
control system. In the latter case, the right-of-way of an AMTV within 
the intersection must be fully protected by the traffic signal. 


4. Route Constraints 

a. Grades and Roughness . Normal grades found in typical city 
streets (+ 10%) and moderate dips, bumps and roughness of the road 
surface should be acceptable. The vehicle design must be compatible 
with the actual route surface to be used . 

b. heather Conditions . AMTV operation in rain or on wet surfaces 
should be allowable. 

c. Curves . The number of curves along an AMTV route should 
be minimized and curve radii should be compatible with headway sensor 
design. Where slowdown is necessary to permit safe negotiation of 

a turn or curve, a positive signal must be provided to the AMTV by 
the guidewire or a roadway marker. 

d. Metal Covers and Gratings . The AMTV guidewire must be 
continuous, and its function involves a.c. magnetic fields. Therefore, 
the location of large steel objects such as manhole covers, gratings 

or rails in the road surface must be compatible with guidewire placement. 
Guide field distortion was found negligible for 7 mph travel with the 
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guidewire 3 inches from the edge of a manhole cover; however, continuing 
the pathway across such a metal plate presents a problem. 


5. Fault Detection and Recovery 

Any system fault, whether of a vehicle or of a fixed element, must 
be signalled in a timely way to system operating personnel. Provisions 
shall be made for manually steering or towing a failed AMTV to clear 
the path of succeeding AMTVs or other traffic. Each AMTV should contain 
a prominently posted placard giving instructions on how to deal with 
the more likely emergency conditions. A system emergency plan should 
be developed to deal with serious accidents. 


6. Maintenance and Storage 

Facilities for of f-line? storage of vehicles, and procedures for 
routine maintenance and repair of AMTVs should be provided. 


7 . Scheduling Control 

A dispatching system, preferably automatic, is required to 
maintain uniform AMTV vehicle spacing throughout the route and to 
execute established level-of-service policies. The dispatching system 
will accommodate daily and hourly variations in passenger demands to 
provide consistent service at a reasonable system load factor. 


8. Safety Provisions 

The system shall be designed such that any single failure cannot 
cause an unsafe condition. This provision may be met by applying fail- 
safe design practices, including the use of redundancy. Where redundancy 
is used, confirmation that each redundant element is operating properly 
must be provided . Steering , braking , headway sensing and motor control 
systems are critical functions which must have these provisions. 


C. SUBSYSTEM DEFINITIONS 

A complete AMTV system contains both vehicles and fixed elements. 
This section defines both the subsystems associated with the vehicle and 
those which are stationary elements. Their interrelationships are 
depicted in Figure 3-1 • The subsystem definitions fulfill the overall 
system requirements discussed above. 


1 . Vehicle. Subsystems 

a. Headway Sensing Subsystem . The headway sensing subsystem 
contains an array of long and short range proximity sensors that can 
detect obstacles far enough ahead of the AMTV to permit a controlled 
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stop, as well as front and side bumper switches that actuate on contact 
with obstacles which have escaped detection by the proximity sensors. 

The contact switches trigger a locked-wheel stop. 

b. Steering Subsystem . The steering subsystem contains a 

set of electromagnetic detectors that receive and resolve lateral error 
signals from the electrically excited guide cable installed in the 
pavement, plus the control actuators which operate the steering control 
linkage to maintain the vehicle on course. 

c. Control Logic Subsystem . The control logic subsystem 
consists of the electronics and associated logic to receive inputs 
from various sensors (headway, steering, tachometer, etc.) and on-board 
switches and generate appropriate command signals for drive motor control 
and braking subsystems. 

d. Drive Motor Control Subsystem . The drive motor control 
subsystem uses command signals from the signal processor subsystem 
to control the traction motor torque. 

e . Braking Control Subsystem . The braking control subsystem 
contains aotuators and drive electronics necessary to apply the hydraulically 
actuated service brakes in accordance with signals generated by the 

signal processor subsystem. 

f. Vehicle Chassis Subsystem . The vehicle chassis subsystem 
consists of the basic chassis, body, suspension, braking system, pro- 
pulsion (drive motor and battery), and other components that are normally 
a part of a conventional manually-controlled or ACT electric vehicle. 

g. "Passenger Interface” Subsystem . The passenger interface 
subsystem consists of safety and operations related devices necessary 
to permit AMTV operations with passengers. Items such as passenger 

stop switches, emergency stop buttons, automatic door operations, boarding 
threshold switches, seat switches, etc., are included. 


2. Stationary Subsystems 

a. Route Subsystem . The route subsystem includes the guidewire 
installation, electric exciters, signalling system for routine stops and 
turns or curves and traffic separators (fence, curb or painted lines). 

b. Intersection Coupling Subsystem . The intersection coupling 
subsystem includes all mechanisms involved in safely meshing AMTVs 
with pedestrian and other vehicular traffic at intersections. Stop 
signs, traffic signal timing modification devices, signal- to-guidewire 
couplers and errant vehicle detectors (to sense possible traffic signal 
violators) are mechanisms that might be used singly or in combination 
at intersections. 

0 . Passenger Stop Subsystem . The passenger stations may include 
sign posts, marked boarding lanes, benches, overhead cover or call 
buttons to signal the AMTV system that passengers are waiting to board. 
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d. Maintenance and Storage Subsystem . The maintenance and 
storage garage consists of a protected facility with proper equipment 
for off-line storage, repair, and routine maintenance of vehicles. 

e. Dispatching and Fault Detection Subsystem . The monitoring 
and fault detection subsystem Includes equipment for monitoring system 
operation, and for detecting and responding to system breakdowns. 
Included also are fault recovery and emergency response procedures. 

The dispatching subsystem consists of equipment for automatic control 
of vehicle schedules, route spacing and load factors. 

f. Check-out Subsystem . Consists of equipment and procedures 
to confirm the correct functioning of system hardware before putting 
an AMTV into daily service. 

D. SUBSYSTEM SPECIFICATIONS 

This section outlines the design requirements for the above 
subsystems, and gives some important numerical parameters involved in 
their design. 


1 . Vehicle Subsystems 

a. Headway Sensing . Although a number of other sensing concepts 
are possible, optical sensors have been used on the JPL AMTV for headway 
sensing. Their capability can be extended for use in a J/20 mph hybrid 
vehicle and the system can be simplified for use in a 1-1/2 mph AMTV. A 
7 mph vehicle requires primary (25 ft) and secondary (8 ft) sensors. For 
a 1-1/2 mph AMTV, secondary sensors alone are sufficient. The sensing 
range of a 7/20 mph hybrid vehicle must extend to 125 ft, necessitating 
a third set of sensors, called the long range sensors. 

The diagram of Figure 3-2 illustrates ideal sensing patterns 
for each of the sensor elements. The rectangular areas shown in the 
figure for each sensor element indicate the area within which the sensor 
must detect an obstacle. Acceptable margins for each area are also 
indicated. The actual individual detector beam areas are elliptical, 
so design compromises must be made to approach the ideal field pattern. 
Further discussions of long-range sensor characteristics, beam definition 
and sensor articulation for extended lateral coverage in curves are 
contained in Section IV. 

The one-foot lateral margin requirement (AW) shown in Figure 3-2 
is defined such that the sensing system must detect low reflectivity 
target from one foot left of the vehicle to one foot right of the vehicle, 
and be insensitive, or blind, to retrorsflective surface which is at 
least two feet away from either side of the vehicle. 

The headway sensor also has longitudinal margin requirements. The 
detection window for the primary system is defined such that low reflect- 
ivity target within 25 feet must be detected and retroreflective target 
more than 40 feet away must not be detected. For the secondary 
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headway sensing system, the detector must respond to a low reflectivity 
target within 8 feet and must not respond to a specular or retroreflective 
target more than 12 feet away. The corresponding figures for the long- 
range sensor are 125 ft and 200 ft. 

A contact-bumper switch will activate the emergency braking system 
on contact to perform a locked-wheel stop. Such a braking system will 
stop a 7 mph vehicle within three feet on dry surface, and a 20 mph 
vehicle within 18 ft. It is possible, by means of a cats-whisker type 
switch extending in front of the vehicle, to perform an emergency stop 
without colliding with the obstacle at speeds up to 7 mph. A design 
trade-off which should receive further attention involves the choice 
between a cats-whisker type emergency contact switch, and a well-padded 
physical bumper design into which the contact switch is incorporated . 

The padded bumper-switch option is the only practical approach for a 20 mph 
system. Although a locked-idieel stop is undesirable, there appears 
to be no other acceptable strategy in the event that am obstacle contacts 
the front of a moving AMTV. 

The headway sensing system design must contain fall-safe or 
self-check features. Failure of the system should cause the vehicle 
to make a controlled stop. 

b. Steering . The cable- following steering technique has been 
demonstrated at higher speeds on larger vehicles than are anticipated 
for AMTV applications (see Refs. 4 and 5). The vehicle should respond 
to a lateral error signal within acceptable steady-state displacement 
error bounds, and without excessive overshoot or hunting character- 
istics. The route curvature radii should be made as large as possible 
and standardized where practicable, to optimize headway sensor function 
in a curve. Vehicle speed within a turn or curve should be limited 

to prevent nominal lateral accelerations in excess of 0.05 g in order 
to avoid discomfort to passengers in the event that the guidewire instal- 
lation is inaccurate. The guidewire should be placed within approximately 
1/2 inch of the true line, and transition radii can be helpful at the 
entrance to curves , even at 7 mph . 

c. Control Logic . The function of the control logic is to 
accept and process all vehicle sensor and manual override signals and 
to deliver appropriate commands to the vehicle drive-motor controller 
and brakes . 

The basic functions of the control logic are listed in Table 3-2 • 
Lower numbered inputs take precedence in case of more than one input. 

In addition to the automatic functions shown in the table, the control 
logic is required to perform function switching from automatic to manual 
mode operation if any manual override command is made. The table illus- 
trates that each of the inputs may originate from more than one source. 

The table defines the overall control logic function for a 7/20 mph 
hybrid AMTV. Logic functions for a 7 mph AMTV or for a 1-1/2 mph vehicle 
are given by an appropriate subset of the total list. Specifically, 
a 7 mph AMTV requires only the first 4 commands, plus the seventh. 
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Table 3-2. General Control Logic Functions for an AMTV 


Command 


Function 


Panic Stop A. Red buttons 

B. Contact bumper 
Stop A. Secondary sensor 


6. Loss of cable 


C. Passenger Stop 


Apply full brakes and hold. 
Auto mode input cancels. 


Slow to stop at controlled 
rate and hold 


Timed Stop Programmed stops 


4. Slow - 2 A. Primary sensor 


B. Steering angle 
input 

C. Road- fixed speed 
zone signal 

5. Cruise - 7 A. Long-range sensor 


B. Road-fixed speed- 
zone signal 


6 . Cruise - 


7. Auto 


20 Enabling road-fixed 
sensor input 

A. Auto mode key 
switch 

B. Steering acquisi- 
tion signal (both 
inputs required) 


Slow to stop at controlled 
rate - pause for passenger 
boarding 

Accelerate or decelerate 
at controlled rate to 2 mph 
and hold speed. 


Accelerate or decelerate 
at controlled rate to 7 mph and 
hold speed 


Accelerate at controlled 
rate to 20 mph speed 

Activates logic; accelerate 
at controlled rate to 7 mph 
and hold speed 
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A 1-1/2 mph vehicle only needs the first three commands, and the seventh, 
which now causes the vehicle to cruise at 1-1/2 mph. 

The control logic subsystem also determines the acceleration 
and deceleration rates and the rate of change of acceleration (jerk) 
which are transmitted as commands to the drive motor controller. 

These rates are a compromise, chosen to ensure a safe stopping distance 
and to minimize discomfort to the passengers. Since standing passengers 
might be permitted, the rates must be consistent with common practice 
in other transit vehicles that allow standing passengers. Typical 
rates for other transit systems are given in Table 3-3 • Although the 
possibility of using higher rates has been discussed, published data 
are insufficient to make a conclusive suggestion (Ref. 14a). 

Table 3-3. Typical Acceleration/Deceleration and Jerk 
Specifications for Other Transit Systems 


Vehicle 

Max . Normal 
Longitudinal 
Acc/Decel . 

Max. 

Emergency 

Deceleration 

Normal 

Longitudinal 

Jerk 

Emergency 

Jerk 

g 

f/s2 

g 

f/s2 

g/s 

f/s3 

g/s 

f/s3 

Morgantown 

.137 

4.5 

.330 

10.5 

.130 

4.2 

.320 

10.5 

AIRTRANS 

.116 

3.8 

O 

QO 

9.0 

.080 

2.5 

- 

- 

BART 

.152 

4.8 

.152 

4.8 

- 

- 

- 

- 


Based on the values given in Table 3-3 the longitudinal acceleration, 
and jerk rates suggested for an AMTV are as follows: 

(1) Normal Accel. /Decel. ...... 0.16 g or 5 fps^ 

(2) Emergency Deceleration . . . . . 0.33 g or 10.5 fps2 

(3) Normal Jerk ........... 0.16 g/s or 5 fps3 

(4) Emergency Jerk 0.33 g/s or 10.5 fps3 

Here, the term ''emergency*' applies to a stop commanded by the control 
logic (a more complex logic than given in Table 3-1 )i in response to 
an abnormal sensor input. The contact bumper would command an 
instantaneous locked-wheel stop. 
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stopping distance as a function of the acceleration and Jerk 
rate chosen are given in Appendix C. Stopping distance from a constant 
speed, and a worst case stopping distance, which occurs with the vehicle 
still accelerating but nearly at the maximum speed, are given in 
Figure C-1 . 


d. Drive Motor Controls . The drive motor current is regu- 
lated to control vehicle acceleration and slow down the vehicle 
before hydraulic braking is applied (dynamic or regenerative braking) . 

Motor overcurrent and overspeed protection should also be provided . 
The sensors for these protective circuits should be separate from those 
used in the main control system to provide backup protection in the 
event that a failure in the motor armature or field, or a failure in 
speed control circuitry occurs. 

e. Braking . While dynamic braking provides redundancy, and can 
even be programmed to absorb most of the energy, friction brakes are the 
primary braking system. 

The friction braking system must be designed in a fall-safe manner 
such that with loss of on-board power, the brakes will operate automat- 
ically to bring the vehicle to a safe stop. Spring-applied, power 
released parking brakes can provide this backup function. The brake 
controller should employ redundant systems with a dual master brake 
cylinder as in passenger automobiles. The integrity of each system 
and the switqhover function should be tested dally as part of the vehicle 
checkout. The braking system should also contain an automatic anti- 
rollback function. Since no AMTV installation will require vehicle backing 
while the vehicle is in service, the anti-rollback function will be 
operative at all times in the auto mode. 

f*. Vehicle Chassis . The principal vehicle configurational 
and safety features were discussed above as part of the system require- 
ments. Other operational requirements are listed below. 

)\ 

( 1 ) Roof - Overhead ps^otection should be provided on any AMTV 
t;hat does not operate exclusively indoors. A hard roof 

iS preferred, but a cloth canopy type roof may be acceptable 
for tram type vehicles. 

(2) Interior Lighting - Interior lighting should be provided as 
appropriate to the application. 

(3) Ride Quality - The ride quality of an AMTV should be 
consistent with those of a conventional low speed transit 
vehicle . 

(4) Interior Moise and Vibration - Interior noise and vibration 
levels should be consistent with standards of conventional 
transit vehicles. 

(5) Cleaning and Maintenance - Interior and exterior surfaces 
of the vehicle should be clean in design and constructed of 
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durable v<aterproof materials to permit rapid and frequent 
cleaning by maintenance personnel. Equipment compartments 
should be easily accessible for service and repair. 

(6) Operational Ranee - The vehicle should operate continuously 
without battery recharge for at least four hours of service. 
Greater endurance is desirable, depending on application. 

A battery charge state instrument should be installed in a 
visible location to indicate to operating personnel when 
battery recharge is required. Depending on the economics 
of the application, it may be desirable to include battery- 
pack quick-change provisions in the design of the vehicle. 
Alternatively, where combustion fumes or added power plant 
noise can be tolerated, a hybrid powerplant (battery and 
heat engine in combination) may be installed. 

g. Passenger Interface System 

(1) Seating Configuration - Seating for enclosed vehicles should 
face forward or to the interior. Aisles should be of sufficient 
width to allow at least one passenger to move freely to or 

from the entrance doors. Seating for open tram type vehicles 
for 1-1/2, and in some cases, 7 mph AMTVs may face forward 
or to the outside. 

(2) Doors - Folding or sliding type doors are appropriate for 
enclosed vehicles. Doors should be placed on one or both 
sides of the vehicle depending on the application, and 
should be wide enough to permit free passage . It may be 
desirable to have several doors , one per seat , for rapid 
boarding. Doors should fit flush to the exterior of the 
vehicle or be faired at the leading and trailing edges 

to minimize injury to a pedestrian who may be standing 
too close to a moving vehicle. Door handles, if used, should 
be flush and of a design which will avoid entrapping the 
hand of a boarding passenger if, for any reason, the vehicle 
moves before boarding is completed . Release switches might 
be placed on the closing edges of doors to open the door in 
the event a small object is caught as the door closes. An 
inhibit switch will prevent the vehicle from moving until 
all doors are completely closed. All doors will remain 
locked while the vehicle is in motion. 

(3) Interior and Exterior Signing - Emergency instructions should 
be provided on an interior placard , as well as cautionary 
signs (i.e., "No Smoking," "Watch Step," etc .) and route 
information signs. Exterior signs should be limited to 
route designations and any boarding instructions that may 

be necessary (i.e., "Entrance," "Exit," etc.). 

(4) Front and Side Bumpers - Pedestrian Protection - All AMTVs 
should have soft bumpers equipped with emergency switches 
at the front and sides of the vehicle. The front should 
be designed to provide a smooth padded bumper effect that 
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will deflect pedestrians or small fixed objects to the 
side with minimum probability of injury. The sides of 
the vehicle should be clean and free of protuberances. 

(5) Sounding Signal - An audible signal may be sounded to warn 
pedestrians of an approaching AMTV. The signal may be 
sounded continuously or be triggered by vehicle headway 
sensors. The signal should not be harsh in character or 
excessively loud. 


2. Stationary Subsystems 

The stationary subsystems Include the guidewire system, right-of-way 
protection, intersection control, curve and turn control, stop control, 
operational monitoring and fault control, and scheduling control subsystons, 
plus the associated checkout and maintenance functions necessary for 
assuring reliable and safe operation of the AMTV. 

a Route Subsystem 

1) Right-of-Wav Guard Fencing . The right-of-way of 7/20 mph 
hybrid AMTV systems will be protected on the street side of 20 m[Ai sections 
by a low protective rail or curb strong enough to physically deflect an 
automobile in a glancing impact. Fencing will be required on the sidewalk 
side of the right-of-way to prevent pedestrians and small animals from 
straying into the right-of-way area. At intersections, the right-of- 

way will be marked on the pavement but will otherwise be unprotected. 

For 1-1/2 mi*i and 7 mi*» AMTVs the right-of-way will be marked on the 
pavement but fences will not be required to prevent entry into the 
right-of-way . 

2) Lateral Control . The steering system reference for AMTVs is 
provided by an uninterrupted burled wire cable or a train of emplaced 
markers located nominally along the center of the right-of-way throughout 
the entire route. Suitable pickups on the vehicle will detect lateral 
deviations of the vehicle from the center of the right-of-way and provide 
corrective signals to the steering system. Any interruptions in the 
cable or train of markers should cause the vehicle steering system to hold 
steering angle vdiile the braking system makes a programmed stop. 

The vehicle sensor for the acquisition signal should be care- 
fully designed to accept a definite lateral excursion by the vehicle, 

(~±8 in.). Road fixed marker signals must function correctly over 
a . wider excursion . Lateral clearance between the AMTV path and any 
curbs or fixed structures alongside it must accommodate the same lateral 
excursion, although a properly functioning AMTV will track the wire 
within a much closer tolerance 1 in) . If a spur or switching point 
is included in the route, techniques for switching must be Incorporated, 
for example each spur will be coded or only the proper sidetrack guidewire 
will be excited - the unwanted sidetrack guidewire excitation will be 
removed either manually or automatically. Existing technology used 
in warehousing systems is applicable. 
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3) Longitudinal Control. Provisions must be made for trans- 
mitting speed zone, turn anticipation and stop commands from the roadway 
to the vehicle. These commands will signal the entrances and exits 
of curves where speed must be reduced and will identify passenger pickup 
points and stop signs for traffic control. These types of signals 
will be time invariant, as opposed to route or spur switching and 
traffic control signals which vary with time and will be handled by other 
means. 


b. Intersection Coupling . Time varying signals which are 
coupled to the traffic signals must be transmitted from the roadway 
to the AMTV . Whether the AMTV preempts other vehicular traffic at inter- 
sections or not, the AMTV and normal traffic signalling system must 
be integrated and interlocked in such a way that adequate stopping 
distance is provided to the AMTV and that at no time can an AMTV and 
cross traffic be admitted to the intersection at the same time. Turning 
traffic will not be permitted during the AMTV crossing periods at 
intersections. Where stop sign intersection control is used, four- 
way stop signs are needed. The AMTV will then respond to the intersec- 
tion as it does to a programmed passenger stop; stopping for a fixed 
period of time, and then proceeding. In the event that the AMTV route 
itself includes crossings, switch points and merging, appropriate coupling 
for speed control must be incorporated to permit safe crossing and 
merging . 


c. Passenger Stations . Because boarding areas for 7/20 raph 
hybrid AMTVs could possibly be located in a 20 mph section of the route, 
special protective measures must be taken to prevent entrance to the 
guideway by animals or small children, since the normal semi-guideway 
protective fencing must be removed to permit boarding. For 7 mph or 
1-1/2 mph AMTV systems, boarding areas should be clearly marked with 
boarding call switches mounted on posts for systems which do not automat- 
ically stop at all boarding stations. Consideration may also be given 

to overhead protection and lighting at boarding stations. 

d. Maintenance Ar eas and Storage Garage . A garage area must be 
provided for storage of vehicles not in service. Facilities for routine 
maintenance should be housed in conjunction with the garage; where necessary 
spare part inventories consistent with the level of field repair will 

also be stored. System maintenance and operations personnel will be 
headquartered at the garage area which may serve also as the operations 
center . 


e. Dispatching and Fa ult Detection . Provision should be made 
to maintain a consistent level of service at all times by monitoring 
spacing of AMTVs on the route continuously and automatically. If bunching 
of vehicles occurs, this condition should be detected and corrected by 
selectively delaying vehicles at a central dispatching station. Means 
must be provided to signal operating personnel about the occurrence 
of an anomaly on the system. In a simple system, monitoring of the 
time between vehicles at a central stop may suffice. In more sophisticated 
systems, some form of communication system may be required. 
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f. Checkout Provisions . Each AMTV must be checked out daily 
before entering service. Special attention will be given to safety 
related items such as headway sensors, steering, and braking systems. 

Some of the vehicle checkout may be performed automatically using on- 
board vehicle self-check features built into microprocessor control 
logic. Additional functional checks may require dynamic tests of the 
braking and steering systems using fixtures or test stands installed 
at the garage. The function of redundant switchover systems in the 
vehicle must be individually checked to ensure that all multiple redun- 
dant paths of critical systems are operable and that the switchover 
logic properly detects and performs the switching function in the event 
of an in-service failure. 

Tests of the stationary system elements should also be performed on 
a daily basis. To perform this checkout, it is expected that maintenance 
personnel will drive an AMTV through the route exercising each signal 
and observing each speedup and slowdown function in accordance with a 
procedure developed for the particular installation. 


SECTION IV 


REQUIRED TECHNOLOGY DEVELOPMENTS 


A. INTRODUCTION 

The purpose of this section is to examine the technology required 
for the AMTV, and to identify those areas which need further development 
in order to achieve a fully operational AMTV system. The discussion 
follows the AMTV system description outlined in Section III. Performance 
of the present AMTV mechanization is compared to the requirements set 
forth there where possible, and approaches toward making the desired 
improvements are recommended. 

The conclusions have been derived partly from the JPL AMTV Phase I 
experiment conducted during February through June of 1976 (see Ref. 1). 
Extrapolations related to the 20 mph mode and other refinements which 
were not a part of the earlier experiment have been made. 


B. RECOMMENDATIONS FOR AN INITIAL APPLICATION 

Efforts needed for implementation of a near-term demonstration 
are listed below. 

( 1 ) Optical Headway Sensor Performance Improvement - The performance 
of the optical headway sensors should be made to conform 

with the specifications given in Section III. Improvements 
in beam definition and response time constant are required. 

(2) Sensor Beam Pointing Control - Provision for directing the 
sensor beam in the direction of a turn is needed. This cap- 
ability must be provided in a way that is commensurate with 
the requirements of the route. For example, a simple straight- 
ahead route with U-turns performed in an area separated 

from other traffic would not require additional sensor capability. 
In general, provision must be made for sensing in a standardized 
long radius curve and in a U-turn. 

(3) Bum per and Emergency Stop Switch Combination - The bumper must 
provide the dual function of protecting the AMTV in the 
event of a failure of the optical sensor system, and 
minimizing the risk of injury to a pedestrian under the 

same circumstances. Some form of emergency stop-on-contact 
capability must be provided over the entire frontal area 
of the vehicle, (including windshield area) and also along 
the sides for protection during a turn. 

(4) Fail-Safe Design - It is important that an operational 
AMTV, even in the early demonstration stages, be made as 
reliable as possible. Further, its design should be 
fail-safe, either by inherent design or by the application 
of redundancy in critical components. 
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(5) Miojpoprocessor Based Control Logic - Although it is not a 
significant cost driver, the flexibility and added 
capability of a microprocessor control and logic system 
will be a valuable asset to a developmental system. 

( 6 ) Safety Measures for Passenger Boarding - Doors or a 
perimeter sensing system must be provided to inhibit the 
vehicle from starting while passengers are in the process 
of boarding or leaving the AMTV. 

(7) Safety and Fault Recovery Plan - A general Safety and Fault 
Recovery guideline must be developed for typical 
applications as well, as unique procedures for specific 
applications. 

(8) Vehicle Operational Ranee - If battery powered vehicles are 
used (an attractive alternative for environmental reasons), 
provisions must be made for simple and rapid change of 
battery modules, appropriate to the specific application. 


C. STATUS OF AMTV TECHNOLOGY 

The required performance of each subsystem element, and approaches 
for achieving it are discussed below in further detail. Required per- 
formance is discussed with reference to the examples of applications 
illustrated in Section II-F. The items discussed are summarized in 
Table 4-1 . An estimate of where each task falls along the line between 
straight-forward engineering and long-range research is given in the 
columns labelled "Type of Effort". Here, the term "Engineering" implies 
that there is some applicable experience, "Development" implies that 
the approach appears to be fairly straight-forward , but involves some 
new advances, and "R&D" implies that basically new technology is needed, 
and it is not clear what the best approach is to solving the problem. 

The columns labelled "Need" identify which of the two described applications 
require the results of the task, or whether the task is aimed at an 
increase in system capability. 


1 . Headway Sensing System 

Headway sensing is a key element of ein AMTV, and refinement of 
this system should receive top priority in future hardware development. 
The headway sensing system has a number of independently functioning 
parts which together protect the AMTV from collision. A set of optical 
sensors provide overlapping coverage for basic straight-ahead collision 
avoidance. A separate set is required for protection during a U-turn 
maneuver. Both are backed up by a combination compliant bumper and 
contact switch. 
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Table *»-1 . Listing of Needed AMTV Technology Developments 
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Table 4-1 . Listing of Needed AMTV Technology Developments 
( Continuation 1 ) 
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5 . Braking 

a) 4 wheel proportional X X 

b) Parking brake X X 

6. Vehicle chassis 

a) 8-12 hr. endurance X X 

7. Passenger Interface 

a) Early Startup 

Protection X X 

b) Audible signals X X 


B. PJXED. -SLEtt gl ilS 

1 . Route 

Discrete marker study X X 

Guide wire installation 

automation X X 

2. Intersection Coupling 

a. Design X X 

b. Right turn capability X X 

c. Left turn capability X X 
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Table 4-1 . Listing of Needed AMTV Technology Developments 
(Continuation 2) 
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In the JPL AMTV, the basic sensors are optical devices, consisting 
of an array of four primary (25 ft) sensors, which together generate 
a beam about 6 in. thick vertically and somewhat wider than the vehicle, 
and two similar but smaller fan beam secondary (8 ft) sensors. These 
are simple fixed devices without scanning elements or precision optics 
(see Refs. 6 and 7). Although the present sensing performance has been 
adequate for the breadboard feasibility demonstration, it would not 
be adequate in an operational situation. The signal- to-noise ratio 
for a black target is marginal , and the interrelated time constant 
of the sensor outputs ( 1/2 sec) is excessive. Beam definition, both 
laterally and down-track, also needs improvement. 

Fabrication and evaluation of an improved set of sensors is 
planned. This set is an array of 7 sensor elements, each element 
performing both the primary and secondary sensor function. One element 
of this set has been built and tested in the laboratory. Its beam 
definition has been found to be satisfactory and sufficient signal 
to noise ratio to obtain a 0.1 sec time response has been obtained. 
Evaluation of this system will continue with tests on the present vehicle. 

Additional specific developments which must be made to improve 
the various sensors are described below. 

a. Long Range (20 moh) Sensor . Sensing elements to detect 
vehicles or other large objects at a distance of 125 ft must be developed 
for vehicle operation at 20 mph. Since no past work has been specifically 
aimed at these requirements, this is a new development task. Light source 
power constraints will limit the capability to detect small black targets 
using an extension of the present primary sensor approach. However, 
reliable detection of other AMTVs or automobiles in a semi-guideway is 
straightforward. Therefore, reasonable performance goals for a development 
task are to achieve; 

(1) Reliable detection and emergency stop for a pedestrian or 
similar size object in a guideway. 

(2) Reliable detection for a programmed stop (normal deceleration) 
for another AMTV or automobile in the guideway. 

In this context, emergency stop means to stop the vehicle using 
maximum braking effort. Stopping in this mode would be an abnormal 
event because the guideway security will have been violated to necessitate 
the stop. 

Other improvements required in order to achieve these goals are, 
optimized signal- to-noise design of the sensors, and improved optical 
design tor beam definition at 125 ft range. 


b. Primary Sensors . The primary sensors carry the main headway 
sensing burden. They must operate without the degree of control over 
the operational environment that can be provided by the 20 mph semi- 
guideway. Except for the different range requirements, the two sensor 
types are functionally equivalent. They must detect any object in 


the path of the vehicle large enough to be a hazard to the vehicle, or a 
pedestrian or another vehicle. 

The following items should receive attention. The specific ideas 
presented apply to both the primary and the long-range (20 mph) sensor 
systems. 

(1) Detector Noise and Response Time Optimization - Detection of a 
black target at 25 ft and discrimination against a distant, 
fully sunlit, white background are conflicting requirements. 
Optimization of the detector channel for best S/N performance is 
needed. Detector response time is inherently coupled with 
noise, and should be considered as a part of the tradeoff. It 
is felt that a detector response time of 0.1 sec is necessary to 
obtain an overall vehicle response time of 0.2 sec, e.g., a 
value which approximates the expected response time of a human 
driver . 

(2) Beam Definition - The headway sensors must detect any object in 
an area approximately 1 ft wider than the vehicle on each side. 
The sensed area must be precisely defined laterally to permit 
unimpeded passing of parked cars. The need for good beam 
definition arises because of the extreme difference in 
reflectivity between a black diffuse target and a 
retroreflective lens such as an automobile tail-light or 
reflector. The sensor beam will always be larger for 
retroreflective targets, because much more light is returned to 
the detector by a retroref lector . 

Two approaches are possible for achieving the required beam 
definition. The one to- be investigated next involves the use 
of an array of several sensing elements, each one a narrow 
well defined ( 6 in. laterally) beam. The other involves the 
development of special (perhaps aspheric) optics designed to 
cover the required area with one or two sensor packages. 

A cost tradeoff exists between the two approaches 
which should ultimately be examined. It involves the use 
of more costly optics in the one case versus a multitude 
of simple sensing elements in the other. 

(3) Vertical Extension of Headway Sensing Area - The present 
sensors cover only a plane near the road surface ( 1 f t 
high). Ultimately, either extension to cover the total height 
of the vehicle will be needed, or because the probability of 
encountering an overhead obstacle is low, such an occurrence 
may be treated as an emergency stop situation covered by 

. a bumper switch. 

(4) Sensor Pointing During Turns - The most frequently encountered 
shortcoming of the simple straight-ahead sensor beam of the 
breadboard AMTV involved lateral coverage during turns. 

With a sensor beam 1 ft wider than the vehicle, and extending 
25 ft ahead , calculations indicate that a turn with a radius 
of curvature of 300 ft or less will compromise the headway 




protection on the inside of the turn. Either coupling of 
the sensor beam with steering angle, or some means of switching 
in or out special sensor elements directed at a slight angle 
to the vehicle centerline are possible solutions. In addition, 
a means to signal the vehicle in advance of a turn appears 
to be needed, not only for lateral sensor coverage, but 
possibly also for speed control. In developing a simple 
mechanization of turn- coupled headway sensing, it will 
be advantageous to limit route turn radii to one or a few 
standardized values. 

Figure M-1 illustrates the order of magnitude of path 
curvature allowable for a straight-ahead sensor pattern 
which is wider by distance AW on each side than the vehicle. 

The curves are computed for different values of AW, and relate 
curve radius R to the distance D from the front of the AMTV 
to an obstacle on the inside of the turn in a position that 
would just be grazed by the vehicle, when it would first 
be detected by the sensor. The curves can be interpreted 
as giving the minimum turn radius that will not compromise 
the straight-ahead sensor, as a function of sensor range. 

Note that the typical radii are much longer than the minimum 
radius of curvature permitted by lateral acceleration (60 ft 
at 7 mph for an 0.05 g lateral acceleration). 

c. Secondary Sensors . Except for beam definition, the secondary 
sensors used on the JPL experimental > vehicle provided satisfactory 
performance. 

In addition to the straight-ahead sensing requirement, the secondary 
sensing system of an operational AMTV must also provide warning of collision 
during a minimum radius turn (U-turn), a function not incorporated 
in the JPL experimental AMTV . Such a turn is performed at low speed , 
and is a separate problem from the cruise-speed turn problem discussed 
above. In a U-turn, the velocity vector of the front of the vehicle 
is rotated by an angle of 45 deg or more with respect to the centerline. 
Suitable short range sensors looking to the side, (and even toward the 
rear for passing traffic) are needed and can be incorporated as part of 
the secondary sensing channel. These can be activated by steering angle, 
but road- fixed signals to anticipate the U-turn may also be desirable. 


d. Contact Bumoer-Switch . The final element of the headway 
sensing system is a mechanical switch-bumper combination which applies 
maximum braking if actuated by contact with an obstacle . A fiberglass 
"Whisker- pole” arrangement was used in the JPL experimental AMTV to 
provide the switch function only. However, it is desirable to actuate 
the switch in conjunction with a compliant but durable bumper structure 
to provide both pedestrian as well as passenger protection in the event 
of a collision. 

The contact switch function must also be extended to cover the full 
height of the vehicle in the event of an overhanging obstacle, perhaps 
by a combination of the switch mechanism with a replaceable windshield. 
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TURN RADIUS, ft 



Figure 4-1. Minimum Turn Radius For Correct Sensor Function 
as a Function of Target Distance for Different 
Sensor Width Margin 4W 


e. Long-Term Developments . Although an infrared proximity 
sensor has been used for the headway sensing function, other approaches 
should also be evaluated. The development of a sensing device that 
can reach to 125 ft, return position and velocity data for the closest 
target, and also scan a swath to either side of the vehicle is technically 
feasible, although much too costly at the present time to permit use 
on an AMTV. Development of this type of capability, in a simple, low- 
cost device is a reasonable expectation from today's rapidly developing 
electronic technology, and would permit raising the cruise speed of 
an AMTV from the present 7 mph while relaxing the requirement for complete 
guideway protection . 


2. Steering System 

The hydraulic steering servo used on the JPL experimental AMTV 
is of conventional design and has proven to be precise and reliable. 
Its design is described in Reference 18. Little improvement appears 
to be required except to enhance its reliability by the application 
of fail-safe design principles. 


3. Control Logic 

The present hard-wired controller processes a number of discrete 
on-off inputs while producing smoothly varying speed signals for drive 
motor and braking control . A fixed parameter ramp generator supplies 
the speed profile program and passive networks limit the rate of change 
of acceleration/deceleration (Jerk) commands. While its performance is 
satisfactory, logic modifications or changes in parameters have been 
awkward to make. 

Development of a microprocessor controller is a desirable future 
task to provide greater control flexibility, added sensor signal 
processing capability, internal redundancy and self-check ability, and 
an ease of function modification which will be of particular benefit 
during the development and evaluation of the vehicle. Also, the micro- 
processor will provide added capability, for example, to select differing 
deceleration profiles depending on target distance and closure rates 
as indicated by times of switching between high-speed, primary and 
secondary sensor channels. Individual vehicles could also be programmed 
to follow different routes using a coded road fixed signal rather than 
requiring roadside equipment to effect switching between routes. The 
microprocessor can be useful in automating prestart checkout procedures, 
and can be used for certain housekeeping functions such as route loading 
(based on seat occupancy count), battery state of charge monitoring, 
etc. The microprocessor can supervise on-board redundant systems and 
provide switchover signals in the event a failure is detected. 


4. Drive Motor Control 

The present JPL experimental AMTV is equipped with an SCR controller 
which provides both traction motor control and dynamic braking. Switching 


4-10 ORIGINAL PAGE Ib 

OEPOORQUAUTY 


between forward power and braking involves inherent delays in the present 
controller, which can be as great as 1/2 sec. Either separate modulatable 
hydraulic service brakes should be used with dynamic braking reserved only 
for redundant use, or an improved controller design is needed. This task 
involves straight-forward engineering and should take advantage of 
existing designs wherever possible. 

5. Hydraulic Service Brakes 

Hydraulically actuated mechanical service brakes are required , 
either as the primary braking system or alternatively, as a dynamic 
braking backup system and for a holding brake. A four wheel modulatable 
service braking system is needed. Proportional control can provide a 
smooth transition between dynamic and friction braking while the vehicle 
is brought to a full stop, yet still permit instantaneous application 
of all wheel brakes for an emergency stop. 

As a part of the braking system, spring applied, power released 
parking brakes must also be incorporated to protect against internal 
power failure due to battery depletion or malfunction. Many of the 
required braking system features are common to other automated guideway 
transit systems but will require careful engineering and performance 
verification. Maximum use should be made of technology from other 
automated vehicle systems. 


6. Vehicle Powerplant 

The JPL AMTV is battery powered , which provides excellent control- 
lability but limited range. Ideally, an AMTV should operate continuously 
over a full day without any refuelling, recharging or other service. 
Increasing the number of batteries will provide marginal range performance 
for a 7 mph AMTV but is likely to be insufficient for a 7/20 mph hybrid 
AMTV. Alternatives include the following: 

(1) A short mid-shift or mid-day high-rate recharge in which 
the vehicle is removed from service for an hour or two 
during a slack load period. 

(2) Battery exchange using quick change mechanisms and 
special garage handling systems to permit a one-man rapid 
battery pack exchange. 

(3) A heat engine-battery hybrid vehicle in which the heat 
engine provides all sustaining energy. 

(4) A heat engine only powerplant which requires refuelling 

only and can easily operate over a full day without attention. 

All of the alternatives suffer limitations. A mid- shift recharge 
service procedure will require significant maintenance personnel time 
to service a large fleet of vehicles. A battery exchange system to 
accomplish the same purpose will require a large inventory of batteries 
to supply the fleet with quick replacements. A hybrid power plant provides 
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an attractive alternative in that it possesses the controllability 
features of the all electric vehicle with the range performance of 
a heat engine only vehicle. Both the heat engine-only and hybrid power 
plants suffer the drawbacks associated with pollutant emissions and 
flammable fuels. 

Considerable work on electric and hybrid vehicles throughout 
the country is being sponsored by the Department of Energy, and many 
of the results should be applicable to an AMTV. 


7 . Passenger Interfaces 

Means for preventing the AMTV from starting up before passengers 
are clear of the doors or entrances need to be developed . On a closed 
vehicle, the doors with their associated protective systems provide 
this function, 

In an open vehicle, protective systems must not only ensure that 
the boarding process is complete, but that limbs and packages are within 
the perimeter of the vehicle. An additional beam-break type of perimeter 
sensor coupled to the secondary sensor channel should be investigated 
as a solution to the passenger containment problem in tram type vehicles. 

Audible signaling devices also may play a part in assuring that 
passengers are prepared for automatic vehicle startup and that pedestrians 
are provided with an audible warning of an approaching vehicle. A 
tone preceding startup and possibly another type of tone, musical rather 
than a warning horn, to indicate the presence of an AMTV to pedestrians 
should be investigated for these purposes. In general, such devices 
must be tested in an operational environment to evaluate their effectiveness. 


D. STATIONARY SYSTEM ELEMENTS 

While many of the stationary systems required for AMTV operation 
have parallels in other transit system concepts, their use in an AMTV 
system is a primary function in contrast to the backup function they 
typically provide in driver-controlled systems. 


1 . System and Route Design 

While route layout will usually be dictated by the constraints of 
particular applications, some general procedures should be developed for 
the design and to establish both the economic and practical feasibility 
of AMTV installations. Included in these should be considerations of, 

(1) Geographical variation of passenger demand within service 
area. 

(2) Unique hazards related to the operational environment, 

(i.e. , weather) fault recovery provisions, and fencing 
and curbing requirements. 
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(3) Maintenance garage and operational personnel requirements. 

(4) Number of boarding areas needed and facilities required at 
each boarding point. 

(5) AMTV related intersection control and route turn or 
switching limitations. 

(6) Minimum curve radii, allowable curve speeds and curve radii 
standardization . 

(7) System installation and operational costs. 


2. Guide Cable Installation 

The wire following steering technology has been proven through 
numerous applications, and its use on early AMTV systems is highly 
probable. Limitations of guide wire installations include placement 
over reinforcing bar, buried or surface rail tracks, manhole covers and 
drainage gratings. These can normally be avoided by the design of the 
route, removal or relocation of metallic objects, aided by the use of 
a phase sensitive wire following technique. A more severe hazard to 
a guide wire installation is ground motion which can result in cable 
breakage. Early demonstration system installations should be located 
in areas where frequent ground freezing does not occur to minimize 
the risk of wire breakage due to this cause. 

The speed and accuracy of the cable installation could be 
significantly improved by development of equipment and procedures to 
mark the road surface rapidly and accurately for saw cutting, perhaps 
using a manually driven AMTV; and development of a specialized device 
or tool to apply backfill material. 

In addition, further work is needed to integrate longitudinal con- 
trol information with the lateral guide cable either through individually 
excited sections of cable or by coded markers placed on the road surface 
at the time of cable installation. An initial study is underway at 
JPL to investigate an alternate method of providing steering references 
by using discrete markers placed at regular intervals in the road surface. 
In this approach, certain types of longitudinal control information 
could be integrated with the lateral reference by the use of coding 
in the placement of the markers. The results of this study will be 
described in a separate report . 


3. Longitudinal Control 

Individual sections of an AMTV route must convey slowdown, 
speedup and programmed stop signals to the AMTV. On-board equipment 
will detect the presence of longitudinal control information and 
activate the motor-controller. At boarding points and signal controlled 
intersections, the on-board sensing systems will command computed 
deceleration profiles based on fixed markers which will bring the AMTV to 
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a near stop, after which it might continue to creep at a very low speed 
until final stopping is accomplished by another marker signal. 

Proper vehicle speed information for individual sections of the 
route can be provided by road- fixed coded markers or by changes in 
excitation frequency or modulation of the cable. For example, when 
a "go" signal is received from an intersection traffic control signal, 
either the cable frequency or modulation of the intersection entrance 
section might be changed to provide the speed command through and beyond 
the intersection. Redundant information could be provided by coded 
markers . 


4 . Intersection Coupling 

Development of effective means of coupling the AMTV system with 
traffic signals will be necessary. To date, no work has been done 
on this subject . Two modes are envisioned ; ( 1 ) AMTV travel through a 
signal controlled intersection can be adapted to a conventional fixed 
timing sequence or, (2) the AMTV may exert priority control over the 
normal signal timing system. In either case, there must be an electrical 
interface between the traffic control signal and the AMTV longitudinal 
control system to ensure that the AMTV will not attempt to enter an 
intersection which is admitting cross traffic. In general, traffic 
along the direction of the AMTV will be allowed to flow during AMTV 
passage through the intersection. An electrical tie from the traffic 
signal to the AMTV system will cause the intersection entrance section 
or marker to command the AMTV to stop on a "yellow" signal whose timing 
is appropriately adjusted to ensure that an oncoming AMTV can stop 
before entering the intersection. All intersections through which 
an AMTV route passes must either be signal controlled or must have 
stop signs for cross traffic . 


5. Turn Capability 

Closely related to signal coupling at intersections is the 
capability for an AMTV to safely execute turns in a mixed traffic 
environment at intersections. A right turn can be implemented in a 
straight-forward manner, but achievement of left turn capability is 
more complex. Possible alternatives for left turn capability include: 

(1) Introduction of an All Red Period in the Normal Signal 
Cycle - The success of this method will depend on assuring 
that the AMTV lane is clear of stopped vehicles ahead of 
the AMTV when the AMTV receives the clear signal. 

(2) Special AMTV Left Turn Lane and Signal - The need for lane 
changes by the AMTV in order to enter the left turn lane 
is a drawback to this method. 
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6. Guideway and Intersection Protection 

Roadside sensors may be required to (1) detect a car on a cross 
street which is likely to run a red light (errant vehicle), and (2) 
detect intrusion into the semi-guideway. While a guideway intrusion 
detector may be conceptually simple, an errant vehicle detector could 
prove more difficult to devise. Such sensing capabilities do not 
presently exist in the required form. If needed, the capability will 
have to be developed. 


7 . Scheduling and Dispatching ■ 

Appropriate procedures and devices for dispatching and spacing 
multiple AMTVs on a single lane need to be developed. Conceptually, 
automatic methods can be devised in which AMTVs are added to or withdrawn 
from service (dispatched) on the basis of occupancy sensors, and vihich 
do not require real time communications from each vehicle to a central 
dispatching area. Similarly, spacing (scheduling) of AMTVs on the route 
can be accomplished by selectively delaying the departure of each AMTV 
from a central dispatching station. The details of such concepts need 
to be worked out and the need or lack of need for real-time communications 
to each AMTV must still be established. 


8. Vehicle Checkout 

As part of a complete AMTV system, procedures and equipment for 
checkout of each vehicle before it enters service will be required, 
and must be developed . Checkout can be automatic , manual or a combination 
of both. Performance tests of the headway sensing, steering and braking 
systems are vital (see specific items in the Hazard and Failure Mode 
Analysis Section) . Perhaps a more difficult task is the checkout of 
system stationary elements such as longitudinal control markers including 
signal couplers, curve and turn slowdown markers, etc. The function 
of each of these should be checked out at least daily. 


E. CONTINUING DEVELOPMENTS 

1 . Fail-Safe and Reliable Design 

As part of the development process involved in setting up an 
operational AMTV system, detailed engineering of each vehicle and 
stationary subsystem must be performed to incorporate fail-safe design 
principles and to achieve reliable operation. This process is not 
really a development activity; existing technology and hardware is 
available and will guide the design in most cases , but many problems 
unique to the AMTV concept must be addressed. The analysis in Section V 
is an initial step in this process. 
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Long-Term Research and Development 


Two specific areas deserve priority as long term Research and 
Development tasks. 

(1) Headway Sensors - Alternative sensor approaches, including 
active scanning devices using laser sources should be examined 
for applicability. Optical methods, radar and ultrasonic 
devices should all be evaluated. Opportunity for improvement 
by the combination of sensor types should also be considered; 
for example an optical scanner for precise beam definition 
plus an ultrasonic device or doppler radar for relative 
velocity determination. 

(2) Blockage - JPL experimental AMTV experience showed that 
blockage of the route by other parked vehicles was a 
frequent occurrence. Service and delivery vehicles were the 
most common offenders, and would be expected in any urban 
area. Therefore, a capability for an automated vehicle to 
recognize a route blockage , maneuver around it at minimum 
speed, and reacquire the cable after passing would be a 
valuable asset. Mechanization of such a maneuver would be 
conceptually simple , through a microprocessor controller 
having prestored passing paths in memory. However, safely 
executing even a simple maneuver like this in a complex and 
unpredictable operational environment presents a very chal- 
lenging problem. Therefore, the attainment of this capability 
must be regarded as a long reuige goal. In the meantime, 

it will be necessary to avert the blockage problem by making 
rules to keep the AMTV path clear, euid subsequently enforcing 
them, a task that the AMTV passengers could help with. 


SECTION V 


SAFETY ANALYSIS 


The demand for safety in transportation systems has alvrays had a 
strong influence on their development and use. Public vehicles such 
as the AMTV must be perceived by their users as safe, and in practice 
this has meant significantly safer than a private auto. Achievement 
of such levels of safety in a new type of system is a challenging goal . 

The safety analysis described in the following pages is intended as 
a first step toward reaching that goal . The methodology described 
in Reference 15 has been used as a guideline. 

The safety analysis was undertaken without preconceived assumptions 
or limitations. However, due to the volume of data generated, the 
scope was subsequently limited in order to concentrate on items unique 
to the AMTV system concept. The AMTV system was assumed to follow 
the system description found in Section III of this report, and the block 
diagram shown in Figure 3-1 was used as a guideline. However, no assumptions 
were made regarding implementation of the elements in the block diagram. 

It should be noted that many of the system and subsystem require- 
ments described in Section III have been conditioned by the results 
of this safety analysis. The safety analysis proceeded in parallel 
with the technology portion of this study and influenced the requirements 
given there. 


A. OBJECTIVE 

The goal of this safety analysis vras to perform a systematic, 
step-by-step examination which would attempt to identify all possible 
hazards, and identify one or more approaches toward eliminating each 
hazard. A separate examination of each hazard was then made to determine 
its severity and to establish priorities for implementing corrective 
actions. 


B. DEFINITIONS 

1 . Safety 

Freedom from those conditions that can cause injury or death, or 
damage to property. 

2. Hazard 

Any condition that can potentially cause injury or death or 
damage to equipment or property. 
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3. 


Failure 


A condition resulting in the inability of the system to perform 
the designated function. A failure may or may not constitute a hazard. 


4. Fail-Safe 

A characteristic of a system which ensures that any malfunction 
affecting safety will cause the system to revert to a state that is 
known to be safe . 


C. METHODOLOGY 

The analysis was performed in two parts. Part 1 was the 
Hazard Modes, Effects and Prevention Analysis (HMEPA) . It included 
all hazards which were related to operation of a properly functioning 
AMTV system. The origin of these hazards tended to be people related, 
involving actions of either passengers on the AMTV, pedestrians, or 
vehicles which interact with the AMTV. Part 2 was the Failure Modes 
and Effects Analysis (FMEA). It involved failures of the AMTV hardware 
and the hazards resulting from such failures. Established techniques 
for conducting failure mode analyses which have been used in space 
mission development were used (Ref. 16). Of course, every failure does 
not necessarily constitute a hazard. In this analysis, the safety 
implications of hardware failures were emphasized, but it should be 
recognized that any failure results in a loss or degradation of service. 
For this reason, high reliability, or the absence of failures is also 
an important goal . 

By its nature, the first steps in the safety analysis tend to 
be qualitative and intuitive. A list called a hazard catalog, which is 
made as complete as possible, was first compiled, based on experience and 
on an understanding of the function of the system. Subsequently, the 
effect to be expected if each hazard is activated and the probability 
of such activation are estimated in order to determine severity. 
Tentative corrective actions are also identified at this stage. The 
complete hazard catalog is presented for reference as Appendix A 
and the failure mode catalog is contained in Appendix B. In order 
to condense the volume of information to a more manageable level after 
compiling the two catalogs, two criteria were used to select significant 
hazards for further consideration. 

( 1 ) The hazard severity estimate 

(2) A judgement that the hazard was unique to the operation of 
the AMTV system, rather than one which other transportation 
modes or the general public are also subjected to. 

The significant hazards thus selected are presented in tabular 
form in Table 5-2 , and are discussed in the Findings and Recommendations 
Section E. below. 


D. PROCEDURE 

A flow plan for the Hazard and Failure modes analysis is presented 

in Figure 5-1. Each block in the diagram, briefly described below, 
represents one step in the process. 

1 . Identify Hazard Categories and Failure Categories 

The initial step in the safety analysis is to establish broad 
hazard categories and to develop a fault tree structure for the failure 
mode analysis. The categories are kept general and comprehensive to 
help avoid unintentional omissions. The elimination of irrelevant 
or less important hazards is done later. 


2. Identify Hardware Failure Modes 

One hazard category is system hardware failure. The first step 
in performing the failure modes and effects analysis (FMEA) is to identify 
all hardware failure modes. This process is also intuitive, but is aided 
considerably by the system block diagram found in Figure 3-1 and fault 
tree diagrams such as Figure B-2. An effort is made to be comprehensive 
in order to prevent inadvertent omissions. Again, the list is subsequently 
sorted during the following risk assessment step. 


3. Identify Failure Effects 

The probable consequence of each failure is identified. This is 
actually done in parallel with the failure identification step. 


4. Generate Initial Preventative Actions 

If it is possible to identify a tentative fix for the failure, it is 
done in the initial preventive action block. This information is used as 
a source of ideas later when more detailed preventative actions are 
developed. Each failure effect is assessed later to evaluate the possible 
hazard resulting from it. 


5. Identify Hazard Modes 

The hazard categories not related to hardware are studied using a 
process analogous to that just described, called the Hazard Modes, 
Effects, and Prevention Analysis (HMEPA). 


6. Identify Hazard Effects 

Having identified all the hazard causes for each hazard category, 
the probable hazard effects are then identified. If a hazard prevention 
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Figure 5-1. AMTV Safety Analysis Work Flow Plan 











technique is knovm at this time, it is also recorded for later reference 
as part of 4 above. 


7. Risk Assessment.. 

A risk Assessment was conducted in order to identify in a reasonably 
systematic way the irreleveint or minor hazards and to identify the 
more important hazard areas for further elaboration. The risk assessment 
was achieved by assigning intuitive ratings to hazard severity (S), 
probability of occurrence (P), and control cost (C). The ratings were 
obtained by having each member of the study team independently assess each 
item, and then averaging their judgements, expressed in numerical form 
as defined in Table 5-1 . The resulting assessment ratings are included 
in the hazard catalog in Appendix A and B. The risk ratings assigned 
range from 4 (catastrophic) to 1 (negligible) for hazard severity 
(S) , from 4 (high) to 1 (almost never) for • probability of occurrence 
(P), and from 4 (none) to 1 (high) for control cost. If the identified 
hazard was felt to be beyond the scope of this study, it was categorized 
as "not applicable". (N/A) and not considered further. 


Table 5-1. Risk Assessment Table 




Values 



Elements 

4 

3 

2 

1 

N/A 

Hazard 

Severity (S) 

Catastrophic 

Critical 

Marginal 

Negligible 

Beyond 

the 

. Scope 

Probability of 
Occurrence (P) 

High 

Moderate 

Low 

Almost 

Never 

of 

This 

Study 

Control Cost (C) 

None 

Low 

Moderate 

High 



8. Identify Significant Hazards 

Important hazards which should receive early attention in future 
AMTV development were identified by applying the following criteria. 

(1) All hazards for which S + P i 6 are considered to be 
slgnlflcauit hazards. 
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(2) All hazards for which S + P i. 4 are deleted from further 
consideration. 

(3) All Hazards for which S + P = 5 are individually assessed; 
specifically, all C = 2 and S = 3 are considered to be 
significant hazards. 

This process was necessary in order to reduce the size of the hazard 
list to a more reasonable length before further examination of the 
important hazards. Note that the risk assessment process creates a 
priority order for the hazard catalog, which, although not explicitly 
presented, can guide future investigation. 


9. Recommend Corrective Actions 

Once the significant hazards were established, a more thorough 
examination was made in order to generate recommendations for preven- 
tive actions for these significant hazards. Information contained in 
the initial preventive actions column was re-evaluated with an ultimate 
goal of achieving a truly "fail-safe" design. Once recommendations were 
developed , they were listed in tabular form as part of Tables 5-2 and 5-3 
on the following pages to complete this study. 

Further steps were identified in the flow chart but were not 
carried out as part of this study. Using the present recommendations, 
a plan for implementing these actions should be drawn. Plans for future 
safety analysis activity were also identified as an item in the flow 
chart. A safety analysis such as this is open ended in nature, as it 
can accept newly identified hazards at step 1 or 2 as they are recognized, 
and the entire process can be iterated in order to refine the priority 
ordering and ideas for corrective actions. 


E. FINDINGS AND RECOMMENDATIONS 

In any initial demonstration of a new concept such as the AMTV 
there will inevitably be hardware bugs and unforeseen safety problems. 

Such events could lead to serious problems in an AMTV system if not 
closely monitored. The frequency of these events will decrease with 
experience. Those using the AMTV and pedestrians that Interact with 
it will gradually become more familiar with it, and its operation will 
become smoother as a result. Without using standby "drivers" op 
"operators" with manual vehicle controls, it will be very desirable to 
provide good coverage of important points on the route during the initial 
learning period by attendants either at the roadside or on the vehicle. 

Bach attendant should have means for stopping the vehicle and subsequent 
manual override, if that should become necessary, using a key. Appropriate 
use of attendants during the critical experimental phase of a demonstration 
could shift a significant load away from foresight and prediction of 
future system behavior into real-time monitoring and correction, a 
much easier task. For example, the question of whether or not an AMTV 
can safely negotiate cross traffic (vehicles or pedestrians) can be 
answered empirically by allowing an attendant at the site in question 


to override automatic control if that becomes necessary to ensure safety 
Empirical answers may well be the only ones possible in the subjective 
area of AMTV interactions with other traffic . 


1 . Significant Hazards and Recommendations 

Seven types of events have been singled out as significant hazards 
for which preventive actions must be developed. These concerns are 
as follows ; 

(1) Collision with another Vehicle - If physical interaction 

between an AMTV and another vehicle is possible a significant 
hazard results, and the probability of collision must be reduced 
to the lowest possible level because of the probability of 
serious injury in such an event. This item is discussed in 
the context that vehicles can interact with the AMTV. It 
is recognized that physical separation is also a preventive 
action, and that in any early demonstration, vehicle inter- 
action should be avoided or sharply limited. 

. (2) Collision with pedestrian . 

(3) AMTV moves while passengers are boarding. 

(4) Objects overhanging AMTV Route or missed by optical sensors. 

(5) Objects beneath the headway sensor range. 

(6) Objects protruding from the vehicle. 

(7) Ice and Snow on Surface - This item is included, even 
though our initial assumption was to limit application to 
an ice- free region. 

The details of these findings and recommendations are contained 
in Table 5-2 following. The left column of the table lists the areas 
of concern. The middle two columns suggest two types of corrective 
actions, either by means of design or by procedure. Remarks, references 
and notes are included in the right column . 


2. Significant Failures and Recommendations 

Six types of failure have been found to result in significant 
hazards. Any one of these six significant hazard types can be thought 
of as a single point failure possibility. The results and suggested 
corrective actions are presented in Table 5-3- The format is identical 
to that used for the significant hazard modes. Each subsystem level 
failure mode identified can result from various specific circuit-level 
failures. The significant failure modes are as follows: 
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( 1 ) Brakes fail due to control failure or hydraulic system 
failure 

(2) Headway sensors fail ''off. 

(3) Steering control failures due to control or hydraulic 
system malfunction. Those failures producing a handover 
response are considered significant failures; passive 
or steering centered failures are not. 

(4) Speed control fails due to control failure or propulsion 
failure. The result is an overspeed or a rollback condition. 

(5) Road fixed stop or slow sensor fails. 

(6) Vehicle chassis fails, for example a flat tire. 
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Table 5-2 


Summary of Hazard Analysis and Recommendations 


Significant 

Hazard 


Recommended Preventive Actions 


Design 


Procedure 


Notes 


Ul 

I 

VO 


1. Collision with vehicle 

A) En route collision. 
Side swipe is 
most probable. 


a) Provide physical pro- 
tection for AMTV path 
such as low curb, or 
chain-link fence. 

b) Provide all-around 
bumper and body enclo- 
sure on AMTV to mini- 
mize damage in minor 
collision 



c) Provide distinctive 
signal lights on AMTV 
or audible warning 
signal 

d) Provide side looking 
proximity sensing 
coupled to steering or 
warning signals 


a) Create rules similar 
to bike-way right-of- 
way laws; use painted 
lanes 

b) Inform the public 
about the AMTV and 
its characteristics. 






Table 5-2 


Summary of Hazard Analysis and Recommendations (Continuation 1) 


Significant 

Hazard 


Recommended Preventive Actions 


Design 


Procedure 


Notes 


Collision by cross- 

a) 

Provide grade 

separation 

a) Limit cross- traffic 

traffic at inter- 


for AMTV 


vehicle speed thru 

section 

b) 

Provide fixed 

roadside 

intersection if 
appropriate 


sensing capability to sup- 
plement the on-vehicle 
headway sensors . The 
primary capability sought 
should be detection of 
vehicles likely to violate 
a red signal 

c) Provide all-around bumper 
and AMTV body design to min- 
imize damage and injury in 
the event of any collision 


a) Existing 

traffic laws, 
if obeyed, 
cover this 
event 


b) A critical 
hazard , 
though very 
improbable 


Table 5-2. 


Summary of Hazard Analysis and Recommendations (Continuation 2) 


Significant 

Hazard 


Recommended Preventive Actions 


Design 


Procedure 


Notes 


^J1 

I 


St 

w£ ■ 

it 

ft »-d 
C > 

I® 


d) Program AMTV to move into in- 
tersection at 2 mph for 1 
length to signal intent to 
cross. Then accelerate to 7 mph 

e) Provide special audible or 
visual signals while crossing 


i 

1 


Collision at 

a) 

Grade separation at a) 

Left turn by AMTV 

intersection 


intersection 

requires an all way 

where AMTV turns 

b) 

special audible and visual 
signals as in 1) B) f) above 

red period for other 
traffic 


c) 

Provide conventional automotive 
turn signals on AMTV, coupled 
to control system. 



a) Safe left turns 
by an AMTV at a 
signalized 
intersection 
poses a diffi- 
cult and subtle 
problem. 

Further study 
and experiment 
is needed 
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Table 5-2. Summary of Hazard Analysis and Recommendations (Continuation 3) 


Recommended Preventive Actions 


Significant 

Hazard 


Notes 


Design 


Procedure 


d) Roadside sensors as 1) B) b) 
above 

e) Provide traffic islands 
for right turn 


D) Vehicle moves into 
path of AMTV too 
close for AMTV to 
stop 

2. Collision with pe- 
destrian . Pedestrian 
moves into path too 
close, or into side 
of moving vehicle 


All items noted under A, enroute 
collision, would be effective 


a) Provide bumper incorporat- 
ing emergency wheels-locked 
stop switch. Surface should 
be smooth, padded to mini- 
mize injury, and must extend 
around sides of vehicle 


a) 


Create rules or envi- 
ronment for pedes- 
trians which dis- 
courage walking within 
AMTV path 


Contact bumper 
will minimize 
damage or injury 


a) Not a criti- 
cal hazard; 
serious 
injury not 
likely. 


: 

V i 

S j 


5-13 


Table 5-2. Sununary of Hazard Analysis and Recommendations (Continuation 4) 


Significant 

Hazard 


Recommended Preventive Actions 


Design 


Procedure 


Notes 


b) Develop control capability b) Familiarize public with 

based on existing headway AMTV characteristics 

sensing components to detect 

a late intrusion into path, 
and react with stronger 
braking 

c) Develop audible signal, 
especially for start up 


AMTV moves while 
passengers boarding 
or getting off 

a) 

Provide doors interlocked a) 

with AMTV control 

Provide instructions 
for boarding at stop 
and on vehicle 



b) 

Provide sensors capable of 
detecting objects close to 
side of vehicle 




c) 

Provide treadle or hand- 
actuated pressure switches to 
hold vehicle during boarding. 
Location should invite their 
use instinctively without 
specific instructions. 



a) Probability 
of occurrence 
is high 






Table 5-2. Summary of Hazard Analysis and Recommendations (Continuation 5) 


Recommended Preventive Actions 


Significant 

Hazard 


Notes 


Design 


Procedure 


4. Overhanging objects 
such as tree limbs 
in path of AMTV 


O SL 

I® 

50 p 




a) Extend contact bumper verti- 
cally. Allows damage to a 
replaceable bumper panel, 
such as an expendable wind- 
shield switch. 

b) Extend optical headway sen- 
sor coverage vertically 

c) An effective bumper-switch 
combination can protect 
passengers and vehicle. 

An emergency stop results 


a) Maintain regular sur- a) 
veillance of route for 
obstructions 

b) Establish rules to pre- b) 
vent movable objects 

such as overhanging 
truck loads from intrud- 
ing on AMTV path. (No 
standing or parking 
signs might suffice) 

c) Provide means for pas- 
sengers to stop vehicle . 

A controlled stop may 

be better than a wheels- 
locked stop because 
there would be less 
inhibition about its 
use 


An overhanging ob- 
struction is an 
anomolous condition 

The possibility 
of an obstruction 
being missed by a 
properly function- 
ing headway sensor 
falls into this 
category. A clean 
mirror or piece 
of glass would be 
an example . An 
unlikely occurence 
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Table 5-2 


Summary of Hazard Analysis and Recommendations (Continuation 6) 


Significant 

Hazard 


Recommended Preventive Actions 


Design 


Procedure 


d) Provide means for pas- 
sengers to report ob- 
structions in a timely 
way 


I 


Small object on 
road surface below 
effective sensor 
coverage 

a) 

Design contact bumper switch a) 
to cover any object large 
enough to cause damage to 
AMTV 

Maintain regular sur- 
veillance of route for 
obstructions 



b) 

Provide strong bumper to min- 
imize probability of damage, 
and to deflect object from AMTV 
path 



6. Object protruding a) 
from AMTV (could be 
part of chassis) 


Side bumper idea presented 
in 2) a) 


a) Prohibit carry-on of 
protruding objects 


b) Use closed vehicle design 
such that object protrusion 
is impossible 


Notes 


) Downward vertical 
curve can increase 
this hazard. 

Refer to Figure 4-1 . 


Table 5-2 


Sv-mmary of Hazard Analysis amd Recommendations (Continuation 7) 


Significant 

Hazard 


Recommended Preventive Actions 


Design 


Procedure 


Notes 


7. Ice/ snow on route or a) Use snow tires or studded a) 
severe weather tires 

b) Design system so that a 

lower speed could be used if 
dictated by road conditions 


Provide monitoring func- a) 
tion capable of antici- 
pating conditions that 
will degrade performance, 
and taking appropriate 
action to ensure safety 


System de- 
scription has 
excluded this 
hazard by ex- 
cluding AMTV 
operation in 
ice/snow en- 
vironment. 
However , fur- 
ther investi- 
gation of this 
subject should 
be made 
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Table 5-3. 


Sunmary of Failure Mode Analysis and Recommendations 


Significant 

Hazard 


Recommended Corrective Action 


Design 


Procedure 


Notes 


1. Brakes fail. AMTV 
will not stop as 
commanded 


O S 


Q, nJ 



a) Provide spring applied, 
power released parking brake 
such that in case of power 
loss, spring will apply brake 

b) Provide 4 wheel braking with 
dual (redundant) brake sys- 
tem similar to normal 
automotive practice 

c) Provide dynamic braking 
capability for redundancy. 
Dynamic braking can be 
service mode to save wear 
on mechanical brakes 


a) 


b) 


Provide for daily 
checkout procedure 
before placing vehicle 
in service 

Provide scheduled 
maintenance plan 


a) Existing 
technology 
used in 
automated 
guideway 
vehicle 
design is 
applicable 
and should 
be used 


d) Provide low hydraulic pres- 
sure sensor which will com- 
mand AMTV to stop 


e) Provide accumulator to main- 
tain hydraulic pressure if 
pump stops 


5-18 


Table 5-3 • Summary of Failure Mode Analysis and Recommendations (Continuation 1) 


Significant 

Hazard 

i 


Recommended Corrective Action 


Design 


Procedure 


Notes 


f) Provide functional redun- 
dancy in logic electronics 
for backup 


2. Headway sensors fail 


A) 


Optical sensors fall a) 
such that obstacle 
not detected . 


Develop an in-service self- 
check capability to detect 
outage of light source 


b) Design sensor so that loss 
of power creates a "yes" 
output, (see present 
design) 


a) Provide daily checkout 
procedure 

b) Establish maintenance 
plan 


c) Provide redundancy in sensor 
design such that a single 
component failure results in 
degraded performance rather 
than functional failure of 
sensor system. Means to 
detect ccHnponent failure 
must be provided. 
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Table 5-3- Summary of Failure Mode Analysis and Recommendations (Continuation 2) 


5 ! 

ri 

j’ 

is 

fi 

< 


Significant 

Hazard 


Recommended Corrective Action 


Design Procedure 


Notes 


B) Mud or dirt on sen- a) 
sor lens; sunlight 
blinding of sensor 

b) 


Provide appropriate lens 
hood to protect lens 

Optoelectronic design 
should provide "yes" out- 
put if detector saturated, 
such as by solar blinding 


a) Provide daily checkout 
procedure . 

b) Establish maintenance 
procedures 


c) Examine proposed route 
geometry for possibility 
of solar blinding and 
eliminate possibility 


C) Contact bumper 
switch fails. 


a) Provide redundancy by having 
independent sections of 
bumper switch area. 

b) Design bumper to minimize 
likelihood of damage or 
injury even with failure 

c) Use power source for sensors 
that is independent from 
propulsion battery. 


a) Provide instructions 
for passengers as guide 
lines for use of opera- 
tional stop switches, 
and emergency stop 
buttons. 
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Table 5-3. Summary of Failure Mode Analysis and Recommendations (Continuation 3) 


Significant 

Hazard 


Recommended Preventive Actions 


Design 


Procedure 


Notes 


3. Steering Pails 


d) Provide emergency stop 
switches for passengers. 


A) 


Sensor fails hard 

a) 

Provide lateral accelerom- 

a) 

Provide daily checkout 

a) 

Existing 

over. Severe lurch 


eter to limit sudden steer- 


procedure before put- 


technology 

can occur . AMTV 


ing input . 


ting vehicle in service. 


used in cable- 

will stop, but can 






following 

stray from desig- 

b) 

Provide redundant sensors 

b) 

Provide plan for 


automated 

nated path by sev- 


with appropriate selection 


regular maintenance 


vehicles is 

eral feet . 


logic. 




applicable 
and should 


c) 

Provide detection for this 




be used . 



condition which applies 
maximum braking. 



b) 

The hardover 
steering re- 


d) 

Limit steering actuator 




sponse can be 



slewing rate to the 




caused by a num- 



minimum value sufficient 




ber of component 



for safe and stable 




failure modes. 



steering function. 




Failures result- 
ing in centered 
steering are 


I' 


Table 5-3 • Summary of Failure Mode Analysis and Recommendations (Continuation 4) 


Recommended Preventive Actions 


Significant 

Hazard 


Notes 


Design 


Procedure 


A) (contd) 


<ji 

I 

ro 


not considered 
significant 
hazards because 
they will 
result in 
the vehicle 
stopping 
within the 
designated 
lane upon 
loss of cable 
acquisition 


B) Actuator fails hard- a) 
over. Effect same 
as above 


Provide electrical limiting 
such that normal operation 
cannot drive steering angle 
to mechanical stop. Provide 
mechanical limit switches 
which dump hydraulic pressure 
suddenly upon activation 


a) Same as above 


b) 


Provide spring centering of 
steering angle under power- 
off condition. 


IfeSf; 
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Table 5-3. Summary of Failure Mode Analysis and Recommendations (Continuation 5) 


Significant 

Hazard 


Recommended Preventive Actions 


Design 


Procedure 


Notes 


C) Acquisition signal a) 
falls "on" . Vehicle 
could move without 
steering control 
from cable. 


Provide redundant acquisi- 
tion signal sensor. Require 
both signals before allowing 
AMTV to move. 


a) Same as above 


D) Guide cable excita- 
tion out of toler- 
ance. Possible deg- 
radation of steering 
function while ac- 
quisition signal 
still present. 


a) Provide redundant monitoring a) Regular maintenance 
capability to keep cable plan, 

excitation within acceptable 
limits; out of tolerance con- 
dition should cause shut- 
down 2 md signal for imme- 
diate maintenance. 


a) Requires 

second inde- 
pendent fail- 
ure to acti- 
vate any 
hazard . 
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Table 5-3- Summary of Failure Mode Analysis and Recommendations (Continuation 6) 


Significant 

Hazard 


Recommended Preventive Actions 


Design 


Procedure 


Notes 


4. Speed control fails 


A) Control logic fails, a) 
so that speed com- 
mand not consistent 
with existing 
inputs. 


b) 


o) 


Provide redundant logic 
function . Redundancy needed 
only for those circuits 
which could result in an 
overspeed condition if not 
obeyed. 

Independent power source 
preferred 

Provide battery level sen- 
sor to stop vehicle before 
propulsion power is lost. 


a) Daily checkout pro- 
cedure 

b) Regular maintenance 
plan. 

c) Recovery plan needed 
for anomalous condi- 
tion to enable vehicle 
to be returned safely 
for maintenance 


a) Existing 
technology 
for automated 
vehicles is 
applicable and 
should be used. 
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Table 5-3. Summary of Failure Mode Analysis and Recommendations (Continuation 7) 


Significant 

Hazard 


Recommended Preventive Actions 


Design 


Procedure 


Notes 


B) Motor control fails 

a) 

Provide independent speed 

Same as above. 

a) 

Tachometer 

on. Overspeed con- 


sensor to detect overspeed 



failure is 

dition results. 


condition and apply brakes. 



possible 
failure mode 


b) 

Provide circuit within con- 
trol electronics to compare 


b) 

Underspeed 



measured AMTV speed with 



condition 



cumisanded speed, and stop 



does not re- 



vehicle if out of limits value 



sult in a 



is detected 



hazard except 
in case of 
rollback, 4C 
below 


C) Motor control fails 
off. Rollback con- 

a) 

See B)b) abbve 

Same as above 

dition results. 

b) 

Provide independent rollback 



detector which applies parking 
brake . 
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Table 5-3* Summary of Failure Mode Analysis and Recommendations (Continuation 8) 






Significant 

Hazard 


Recommended Preventive Actions 


Design 


Procedure 


Notes 


5) Road fixed stop (or a) 
slow) sensor fails. 

Could result in 
collision if it 
occurs at 2 in inter- 
section. Failure b) 
of a road- fixed slow 
signal control re- 
sults in an over- 
speed condition. 

c) 


Provide fail safe or re- a) 
dundant design for those 
components which couple AMTV 
motion with a traffic signal 

Provide redundancy thru con- 
trol of excitation of a seg- 
ment of guide cable which 
is interlocked with signal. 

Designation of different 
speed segments of route must 
be redundant or fail-safe 
(Faster speed requires 
explicit enabling input such 
as a guide cable modulation 
to be present) 


Same as above 


d) Design stop sensors to func- 
tion over wider lateral excur- 
sion of steering than allowed 
by acquisition detectors 


A critical 
failure if 
stop signal 
is associated 
with traffic 
signal coup- 
ling, or is 
at a traffic 
stop sign. 
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Table 5-3 


Summary of Failure Mode Analysis and Recommendations (Continuation 9) 


Significant 

Hazard 


Recommended Preventive Actions 


Design Procedure 


Notes 


6 . 


Flat tire or other a) 
chassis failure. 

AMTV will try to pro- 
ceed, resulting in 
further damage and 
possibility of sec- 
ond failure 


Develop sensor based on 
accelerometers which respond 
to abnormal bumps or tilts. 


a) Daily checkout 

b) Maintenance plan 

c) Instructions to passen- 
gers on AMTV giving 
guidelines or stopping 
vehicle 


Existing 

technology 

applies. 


d) 


Provide system surveil- 
lance, perhaps at one 
point on route. 
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APPENDIX A 

SAFETY ANALYSIS DATA 


HAZARD MODES,: EFFECTS, AND PREVENTION ANALYSIS (HMEPA) 

HAZARD CATALOG 


NOTE 

This Hazard Modes, Effects, and Prevention Analysis (HMEPA) 
deals with those hazards involving interactions between 
humans, other vehicles, procedures, and environments. It is 
assumed that the AMTV is operating properly; hazards origin- 
ating from hardware failure are covered under the Failure 
Modes and Effects Analysis (FMEA). 




















Appendix A. AMTV Hazard Catalog 


Hazard 

Categories 


Hazard Plsk Freli'^iinary 

Modes Hazard Effects 5 E C Prevent icn/Penark 


A. Collision 
with 
vehicle 


Vehicle collides with AMTV 

Cidesvipe is probable. 

Both AMTV 

u :> i* 

a. 

Provide rlrbt-of-vay for 

on route 

and passenger could receive 

consider- 



AMTV over other vehicles. 


able damages and injuries* 



b. 

Provide all around bumper 
to minimize damage in thf 
event of a minor bump. 





c. 

Install a signal light to 
indicate that AMTV is 
approaching. 


> 

I 

u> 


2. Vehicle racves into AMTV 
path too close 


A.MTV at the present tice does not have 
the capability to detect approaching 
objects outside of its lane. AMTV 
unable to stop before collision. 
Sertcus injury not likely. 


? 2 2 a. Sensitize the "all around 

bu^jper" mentioned above 
such that any object 
within six inches from it 
will cause it to stop or 
slow the vehicle, 
b. Indicate A.MTV route with 
double yellow lines or 
curbinv such that 
vehicles will not try to 
edge into that lane. 


3. Cross traffic collision Critical hazard. Both AMTV and 

passengers could receive consid- 
erable damages and injuries. 

a. Provide grade separation. 

b. Provide roadside sensors 
for warning of rieht-of- 
way violation. 

c. Fail-safe signal 
coupling required. 

d. Provide warnine litrhts. 


4 2 3 It has been suggested that 

AMTV should make a certain 
amount of noise. 


Appendix A. AMTV Hazard Catalog 


Hazard 

Categories 


Hazard 

Modes 


Hazard Effects 


Risk Preliminary 

S P C Prevention/Remark 


Left/right turn collision This could result in any of the above 2 ? a. /iMTV must have direction 

three hazard conditions. indicators to tell other 

vehicles that it is Koine 
to make a turn. 

b. /»MTV may trl^ffer inter- 
section signals to be all 
red for sufficient dura- 
tion before makin*? a safe 
turn . 

c. AMTV miffht not start the 
left turn from the left- 
most lane, therefore it 
is very important that 
vehicle behind AMTV are 
warned by signal lights. 

d . AMTV path best be 
located adjacent to 
pedestrian sidewalks. 

Make the riffht turn simi- 
lar to an automobile 
alon*r the right curb and 
only on jrreen light. 

Make the left turn bv 
first having all four 
signals turn red and 
then enter the inter- 
section to make a left 
turn . 




Appendix A. AMTV Hazard Catalog 


Hazard Hazard 

Categories Modes 


f 


Hazard Effects 


Risk Preiir’inarv 

S P C Prevention/Reraark 


NOTES 


Green 


Red 


Green 



Right Turn 


> 

I 

U1 


Red 


Red 

Ped 


Red 


Left Turn 


AMTV Route 

Ref: HMEPA A.^i 




5. Vehicle backs into AMTV 
(AMTV may be already 
stopped) 

Vehicle exiting frorr driveway could 
hit AMTV broadside. Vehicles backinc 
into parallel parking could run into 
AMTV; AMTV does not backup. 

? 2 3 

C w 

A. Collision 
with pedes- 
trian 

t . Pedestrian or cyclist 
enters path too close 
for AMTV to stop 

Pedestrian/cyclist coulu be injured 
if walked or strayed into side of 
moving AMTV. 

2 2 2 


Public education as well 
as some public relations 
will reduce this risk as 
well as the ones (1 thru i») 
above. 

a. Education of the public is 
needed . 

b. Make AMTV physically smooth 
and padded so it won’t in- 
flict injury other than 
knockintr a person off balance. 

c. Incorporate emergency stoo 
switches in bumner. 

d. Develop special locic to 
detect anomalous condition 
from headin«r sensor inputs 
and command ouick stop.’ 










Appendix A 


AMTV Hazard Catalog 


Hazard 

Categories 


Hazard 

Modes 


Hazard Effects 


Bisk 
S P C 


B. Fire; 1. Excessive heat on flam- Seat material, etc., could catch fire 1 1 ? 

Environ - mable materials from concentrated heat source. 

mentally 
Caused 


2. Burning fire on AKiV route Fire could be intentionally set or 3 I 1 

could be from other cause, such as a 
burning tree. 


> 

I 

ON 


3. Lightning strikes 


Occurrences of lightning strikes are 
conceivable . 


Fire; 4. Passenger smoking 

People 

G.engr.at>ed. 


Passenger smoking might be both 2 3 1 

irritating other passengers and 
causing burns and fires to AMTV. 


5. Passenger carrying on 
explosive luggage 


An accident from the carry-on N/A 

explosive can incur great damage. 


6. Intentional!'; Set Passenger could intentionally set AMTV N/A 

on fire. AMTV could be destroyed from 
such an act. 


Preliminary 

Prevention/Remark 


Use non-flammable materials 
only. 


AMTV sensors will not he 
able to detect this unless 
solid material is there. 
Educate the public to the 
existing emergency stop 
switch. 


a. Prohibit smoking on AMTV, 

b. Use non-flammable 
material. 


Prohibit carry-on of 
explosives. 


Promote good public rela- 
tions during early .«t?ges. 
Ask for community co-oper- 
ation. Advocate passenger 
policing system. 


Appendix A. AMTV Hazard Catalog 


Hazard Hazard Risk Preliminary 

Categoriea Modes Hazard Effects S P C Prevention/Remark 


C. Weather 
effects 


Rain water damaging AWTV Rain water could damage the AKTV and 

its electronics , 


232 AMTV has to be designed to 

suit the weather of the 
local area. 


I 




' 4 ' 


2, Sensor failing operation 
in fog 


Optical sensors could be Insensitive 
in fog and other low visibility 
conditions. 


3 1 2 This mode has to be further 

studied to isolate the 
limitations of sensor capa- 
bilities. Present design 
'^‘eouires visibility of 25-ft. 
tense fog will produce a 
sensor response, and a 
slow command. 


3 . Contact bumper interferred Low overhead power line could produce 1 1 1 

by EMI from overhead power EMI to alter the sensitivity (or pick 

lines up noise signals and affect contact 

bumper performance. 


Any interference signal 
would fail the bumper in 
stopped condition. 


Mud, dirt, etc., obscure Optical sensors will degrade, 

sensor vision 


3 2 a. Require regular main- 

tenance procedure, 
b. Provide appropriate pro- 
tective lers hood. 


5 . Ice/snow on route 


AMTV could slide if traveling on i v.' ^ ? 3 a- Use snow tires at locales 

snow. Collision can result. where ice/snow exists. 

b. Heating of AMTV path 
also suggested . Need 
further study on this. 


6. Severe weather 
conditions 


Hal Is tom, heavy snow, flooding, 
earthquake, high wind, extreme 
cold weather, etc., can all degrade 
perforBance or cause system failure. 


N/A Peslgp AMTV to suit local 

weather conditions. Provide 
procedure to avoid operating 
in hazardous environment. 


Appendix A. AMTV Hazard Catalog 


Hazard 

Categories 


Hazard 

Modes 


Hazard Effects 


Risk Preliminary 

S P C Prevention/Remark 


D. Vandalism 1. Hot wire AMTV 


AMTV performance would be unpredict- 
able and damages and injuries could 
results. 


? 2 ? Design components such that 

(N/A) no easy accessibility was 

available. Tires be placed 
behind locked chassis doors 


2. Brake line cut 


AMTV will be endangered. 


32? Have brake line not acces- 

(K/A) sible. Provide brake line 

pressure detection tech- 
nique. Low pressure, AMTV 
will stoo. 


> 

I 

oo 


3. Put blinders on sensors AMTV will probably not move- But if 

blinders were of low emissivity, 
sensors could be inactivated. 


2 ? ? Simulate this mode and 

(N/A) obtain information on 

effects. Public cooperation 
needed for prevention. 


4. Unscrew the seat from AMTV Passenger could be injured from 

unanchored seat. 


2 2? Hi^gular maintenance. Seat 

(K/A) fastening locations 

inaccessible from outside 
of vehicle. 


5. Time bomb AMTV Could be very serious, but probability N/A Promote public relations and 

of occurrence is no greater than an provide reliable service, 

average public location 


6. Intent..onal diversion of 
AMTV from route 


Degrade system operation; cause 
possible collision. 


? 2 2 Al^V will stop when eu-ide- 

(N/A) Wire is lost. Flimina.^ie 

manual override devices on 
AMTV. Instead, recuire kev. 
See also manually ooeratinv 
for fun. 


Appendix A. AMTV Hazard Catalog 


Hazard 

Categories 

Hazard 

Modes 

Hazard Effects 

Risk 
S P C 

Preliminary 

Prevention/Pemark 


7. Guidewire disruption 

Preaking of guidewire will cause 
system to stop. 

? ? ? 
(N/A) 

Exciter should have rnean.*? 
to realize when a segment 
of guidewire is dlsrunted 
and activate warnin*^. 


8. Manually operating for fun 

Result unpredictable. 

? ? 2 
(N/A) 

All the manual mode 
opera timr parts, such as 


Joy stick, acnelerator, 
etc., should be on a olup'-in 
unit which Is .mapuallv 
carried bv servlceiran . The 
plue-in connector has a 
locked cover to prevent 
tamnerinp. 


9. Let air out of tire 


AMTV could tilt and cause deroutenient . 
Vehicle will stop from loss of i^uide 
cable, but nevertheless collision 
could result. 


222 Make tires hard to «et to by 

(>!/;) havin? a cover. The use of 

dual chamber tires will hold 
pressure, even if the outer 
chamber fails. 


10. Hijacking by adding guide- Could lead vehicle to undesirable 

wire location. Could cause unpredictable 

damage. 


213 a. Do not reveal what fre- 

(N/A) quencY the ffuide cable 

carries. 

b. Make control signal 
more complex than 
single freouencv. 


11, Additional stops Induced Would delay trip and make usage of 

system less attractive. 


211 a. Make stop markers more 

(^VA) complex than a single 

maflrnet . 

b. System surveillance 
function . 


ORIGINAL PAGE lb 
OF. POOR QUALITY 
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AMTV Hazard Catalog 


Hazard 

Categories 


Hazard 

Modes 


Hazard Effects 


Fisk Preliminary 

S P C Prevention/Femark 



E. Electrj-c 
shock 

1. Electrostatic charge from 
friction between seat and 
clothing materials 

Passenger could get a shock. 

1 1 1 
(P/A) 

Use seat material which 
will not collect charge. 

> 

1 


2. Passenger hand stop switch 
exposed 

Passenger receiving shock from stop 
switch. 

1 1 \ 
(N/A) 

Improbable injury to pass- 
enger. Voltage on switch is 
is *> volts. 

o 


3. Battery shorted to AMTV 
body 

Heat or spilled electrolyte 
could cause injury 

1 1 1 
(P/A) 

One side of the batterv is 
connected to the AMTV frame, 


using a small wire. Should 
the other terminal of the 


battery be connected to the 
frame the wire would melt. 
The purpose of the batterv 
being connected to the frame 
is for EMI reduction to the 
electronics. 
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AMTV Hazard Catalog 


Hazard 

Categories 


Hazard 

Modes 


Hazard Effects 


Risk Preliminary 

S P C Prevention/Remark 


f*. Passage 

V. Overhanging objects above 

AMTV could collide with 

an overhang 

432 

a. Maintain routing surveil- 

inter- 

ference 

(Route 

blockage) 

optical sensor range 

tree limb, sign, etc. 
injury might result. 

Damage and 


lance to assure that all 
overhangs are at least a 
certain height margin 
away 

b. Extend contact bumper 
vertically to full AMTV 
height to detect this. 


2 . Objects on route below 
sensor range 


A big rock or fallen tree limb could 
could cause vehicle damage and 
passenger injury. 


322 a. Sensor range should be 

expanded to include 
vertical plane as well 
as the horizontal. 

b. Design the lower front 
part of AMTV to a snow 
plow shape so that it 
will be able to push the 
object on route along 
the way rather than run 
over it. 

c. Design (b) above into a 
center-pointed shape so 
that object on route will 
be pushed to the side and 
not be run over. 

d. Assume b) and c) 
above do not have 
sharp edges. 


3. Hole in pavement or 
excavation 


AMTV may be damaged and passenger 
injured. 


232 a. Route maintenance 

function . 

b. Procedure for notifi- 
cation of AMTV personnel 
if hole must be dug. 
o. Develop sensor to 
detect holes, 
d. Include inspection for 
holes as part of daily 
route checkout. 


Hazard 

Categories 


Hazard 

Modes 


> 

I 

tv 


U. Parked vehicles partially 
blocking AMTV path 


5. Object close to side of 
AMTV 


6. Protruding object from 
AMTV 


A. AMTV Hazard Catalog 



- j 

Collision sensors will detect this and 1 U 2 Post signs prohibiting ^ 

prevent problem, but it will break the stopping. Public education ' i i 

system down and cause poor service. program during early stages. ♦ 


Boarding or deboarding passenger could 122 Safety panel on side of AMTV 

be crushed between AMTV and object. to cause stop. Extension of 

bumper sensitization idea is 
applicable. 


Pedestrian or deboarding passenger 
could get knocked down or clothing 
caught. 


? 2 2 Same as above. Also pro- 

hibit carry on object pro- 
truding to the outside of 
AMTV periphery. Enclosed 
AMTV will eliminate this 
problem. 


I 

■* 

I 


J 


Hazard 

Categories 


Hazard 

Modes 


G. Passenger 1. Passenger boarding from 

not the wrong side of AMTV 

following 
instruc- 
t ion 



2. Passenger boarding/leaving 
AMTV without pressing 
stopping switch 


3. Passenger breaking other 
safety regulations 


4. Passenger injured by 
other vehicle during 
boarding 


5. Passenger not being 
careful 


A. AMTV Hazard Catalog 
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Hazard 

Categoriej? 


Hazard 

Modes 


H. Passenger 1. Robbery 

vulner- 
ability 
to muggers 


2. Kidnap 



A. AMTV Hazard Catalog 


Hazard Effects 

Risk 
S P C 

Preliminary 

Prevention/Remark 

The aged and the handicapped 
could be especially vulnerable 
to this mode. Consequence of 
occurrence could also affect 
the community’s acceptance. 

N/A 

The lack of attendant or 
possibly other passengers 
creates a need for some 
means to ask for assistance. 
Further study as to route, 
schedule (whether to provide 
service during late evening 
hours), street lighting, 
etc., needed. 


Consequence of single occurrence N/A Further study needed. It 

could affect the acceptance of has been suggested that the 

the system by the public. inside of AMTV be highly 

visible from the outside by 
means of good lighting, 
windows, etc. Lockable 
compartments and alarm 
button are other suggestions. 
Utilize practices and tech- 
nology from AGT systems. 
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AMTV Hazard Catalog 


Hazard 

Categories 


Hazard 

Modes 


Hazard Effects 


Risk Preliminary 

S P C Prevention/Remark 


I, Other 


Motor power not able to 
overtake gravity on an 
incline during initial 
starting 


On an incline, with the vehicle 
initially at a stop, the vehicle 
Will roll backward at the instant 
the brake is released and the 
motor power is applied. 


421 A study must be performed 

to assure that the motor 
will within a fraction of a 
second from the release of 
the brake be able to over- 
take the gravitational force 
on AMTV and proceed to 
climb. Rollback protection 
is required in the event 
of inadeqUancy of pro- 
pulsion. 


Radiation from 
infra-red sensor 
light source 


Eye damage if 
radiation level 
high. 


313 Examine design for 

compliance with 
ANSI Z-136 at 
each design 
iteration. 
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AMTV SYSTEM 
FAl LS 
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VEHICLE CHASSIS 
SUBSYSTEM FAILS 

■ ■■! 

: , ■ , ! 

, 1 

STEERING 
SUBSYSTEM FAILS 


ROUTE CONTROL 
FAILS 


SPEED CONTROL 
SUBSYSTEM FAILS 


Figure B-2. AMTV System Fault Tree 


HEADWAY SENSOR 
SUBSYSTEM FAILS 









Appendix B. Failure Induced Hazard Catalog 



Risk Preliminary 

Description Failure Modes Failure Effects S P C Prevention or Peraarks 



I. VEHICLE 
SUBSYSTEM 
FAILS 


I. A 

Servo-Tek Model No, 

1. Output open (no 

When tach gives no 

M 3 3 

a) 

A fail-safe design is 

TACHOMETER 

SB-7^0A-2. DC gener- 

output voltage) 

(low) signal, vehicle 



needed to eliminate 

FAILS 

ator type with rotat- 


accelerates; high 



hazard effects. 


ing armature and two 
brushes. Typical 
ratings: lOV, 5mA. 


signal decelerates . 


b) 

Modify design by adding 


Tach tracks motor and 





a comparator to compare 


feeds signals back to 





command voltaee Vq with 


speed control servo 





tach signal V^. If 


amp. 





Vx<Vci signal vehicle 


to stop. This comparator 
can also control over 
speed fay stopping the 
vehicle when Vx>Vc Cmax), 
where Vq (max) is the 
command voltage for 
maximum speed. 

c) Alternate independent 
overspeed prevention 
system Should be inves- 
tigated, Utilize 
existing technology 
being used by other 
vehicle systems. 


2. Output short (no 
output voltage) 

Same as above 

'13 3 

Same as above 

3 . No input (broken 
or slipping tach 
shaft) = low out- 
put. 

Same as above 

'13 3 

Same as above 
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Description Failure Modes 

I.B BATTERY 6 x 6 Volt batteries 1. Completely dis- 
MALFUNCTIONS 250 amp-hr life , 200 charged 

amp max, 60 amps level 
cruising ave. 100 amp. 



i 

j 


2. Shorting 
or exploding 


3. Leaking 


M . Low ambient 
temperature 



Hazard Catalog 


Failure Effects 

Risk 
S P C 

Preliminary 
Prevention or Remarks 

Dead battery will 
affect every part of 
vehicle operation^ 
Steering out of con- 
trol, brakes will 
nob work, etc . 

2 4 2 

a) The addition of a 

battery state of charge 
detector. Do not allow 
AKTV to start new route 
loop if battery state is 
too low. The evaluation 


of a longer battery life- 
time is needed . Prakes 
should be redesigned to 
be fail-safe such that 
the brake will apply if 
power lost. 

b) Provide separate 

uninterruptible power 
supply (UPS) for 
critical control 
functions. Low voltage 
tolerance of control 
system is also needed. 

Shorting and exploding 212 
can cause fire and 
other injuries. 

Leaking can cause 212 

burns or hardware 

damage 

Low temp will make 212 

battery state of 
charge prediction 
a more difficult 
problem. 


j 

i 
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j, 

t 

I 


! 




Description 

Failure Modes 

Failure Effects 

Usk 
S P C 

Preliminary 
Prevention or RemarVs 


I;C. MOTOR 

DC Series motor, 2HP, 

1 , Motor open 

Loss of motor drive 

2 1 2 

Comparator mentioned 


FAILS 

36V 2800 rpm, GE 


capability will 


in I.A is needed here 



model *l8JB-503 D. 


degrade vehicle 


to stop the vehicle when 

r- : ^ ; ■■■; ; ;; ^ 


Motor tracked by 


stopping ability/ 


Vx>V0(max) . 

t-': . . 


tach. and controlled 







by SCR motor cpn- 

2. Motor shorted 

Motor might over- 

2 12 

An overcurrent protection 

' 1 . 


troller 


heat and cause 


or thermal overload is needed 





burning. 






3. Motor-tach 

See I.A with no (low) 

12 

Comparator mentioned 

r‘^1 ; CT> : ■ • 



separation 

tach signal, vehicle 


in I.A applies here* 





will accelerate 






Motor disengaged 

If this mode occurs 

} 2 

A speed detection system 




from drive shaft 

when the vehicle is 


not tied to the motor 





on a slope, the 


must be added to the 

; t 




motor tach , and 


vehicle to provide a fail- 

i 




electronics could 


safe design. The util- 





all be functioning 


ization of existing tech- 





properly, yet the 


nology is desirable. 

J 




vehicle will be put 



: 




of control . 




I 


I 
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Description 

Failure Modes 

Failure Effects 

Risk 
S P C 

Preliminary 
Prevention or Remarks 

I. D SCR 
MOTOR 
CON- 
TROLLER 
FAILS 

GE C-155 Model 100. 
Controls the amount of 
current supplied to 
motor by varying the 
frequency of square- 
wave pulses. Has dual 
direction capability, 
ie, forward and re- 
verse directions. 

1. Output too high 

2. Output low or 
grounded 

Motor will overspeed 
which in turn will turn 
tach at a faster rate. 

Low motor input. 
Rollback condition 
results. 

3 2 2 
12 2 

Comparator mentioned in 
I. A is needed here to 
stop the vehicle when 
V<p>Vc(raax) . 

Under speed comparator 
in I. A will stop vehicle. 



3 . Output erratic 

Motor power applica- 
tion variable. Ride 
might be less com- 
fortable. 

2 2 2 

If amplitude exceeds high 
and low limits, comparator 
will stop Vehicle. 



1|. Degradation or 
loss or bi- direc- 
tion capability 

Dynamic braking could 
be degraded. Motor 
forward drive capa- 
bility could be de- 
graded also. 

2 2 

Undesirable event. Further 
investigation needed, 
although not a single point 
failure, Need to have 
capability to switch from 
the detection of this 
failure mode to using 
redundant braking con- 
trolled by the under/ 
overspeed comparator. 



5. Output stuck ori high 
regardless of input 
command 

Vehicle will continue 
increasing speed. 

3 2 2 

a) Comparator should detect 
this failure mode. 

b) Independent overspeed 
detection. 



6. input (from 

speed control) re- 
mains on high 

Vehicle will continue 
to travel at a con- 
stant speed. 

3 2 2 

Fix should be implemented at 
previous stage, speed control 
servo amp. 



7 . V input ( from 
speed control) 
shorted to ground 
(low) 

This is same as last 
stage speed control 
servo amp tran- 
sistor C-E Short, 

This occurrence fails 
motor power. 

12 2 

No action required, since 
vehicle will not move. 
Utilisation of existing 
technology is desirable. 



Appendix B. 



Description Failure Modes 


I.E BRAKE 1. Leaks 

ACTUATOR 

rm-s 

2. Fails on ( stuck 


3. Fails off 



' 


Hazard Catalog 



Failure Effects 


Risk Preliminary 

S P C Prevention or Remarks 


Loss of hydraulic 
pressure 

2 3 3 

No sure way to prevent 
this from happening 
except by regular main- 
tenance and checkout. 

Loss of hydraulic 
braking capability, 
however vehicle would 
not go anyhow. 

112 

The hydraulic brake 
fluid is not compatible 
with the hydraulic 
system fluid: the two 

Loss of hydraulic 
braking capability. 

4 12 

are separated by a 
floating piston . There 
is no provision to check 


the brake fluid! Need a 
reservoir with sensor 
4 detect fluid level. 
Present vehicle has two 
wheel hydraulic brakes. 
Future vehicles should 
have 4 wheel brakes with 
dual hydraulic brake sys- 
tem 4 an indicator to 
tell if one system is 
defective. 
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Description 


Failure Modes Failure Effects 


Risk Rrelioinary 

S P C Prevention or Remarks 


Od 

I 

vp 


I>F VEHICLE 

CHASSIS 

FAILURE 


Tram consists of 
tires, axle, and 
frame. 


Flat tire 


o o 
a a 





2. Axle and frame 
malfunction 


Vehicle operation 3 2 2 

with flat tire C 3) 

will be unpredictable 

and therefore hazard^ 

ous 


Occurrence most un« 311 

likely although effect 
could be significant. 


a) Use dual chamber tires. 
Even if outer ruptures, 
tire will still hold 
pressure , 

b) Road clearance detector. 

c) System surveillance at 
one point on route. 

d) Regular maintenance 

e) Daily checkout 

Axle conservatively rated* 


i >LktSa,ii • I 
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Risk 

Preliminary 


Description 


Failure Modes 

Failure Effects 

S P C 

Prevention or Remarks 

I.G 

HYDRAULIC 

BRAKES 

l-iALFONCTION 

Two brake shoes forced 
against brake drum via 
hydraulic brake 
cylinder 

1. 

Hydraulic brake 
cylinder leaks 

Hydraulic fluid loss 
will cause degreda- 
tion. 

2 3 3 

See remarks in X.E, 
Periodic maintenance 
and checkout procedure 
should be generated to 
eliminate this mode- 



2. 

Hydraulic brake 
cylinder jams 

Brake could get stuck. 

2 1 1 

Same as above. 



3. 

Worn brake shoes 

Braking will be 
degraded . 

2 1 1 

Same as above. 
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Description 

Failure Modes 

Failure Effects 

Risk 
S P c 

Preliminary 
prevention or Remarks 

I.Hv MANUAL 

OPERATIONS 

FAIL 

Operation of vehicle 
can be manually con- 
trolled thru various 
manual mode attach*^ 
ments including brak- 
ing, steering, accel- 
erator* and forward/ 
backward control. 

Any of manual mode 
operations fail.* 

a) Unpredictable. 
Could compromise 
ability to return 
vehicle for service 
in the event of 
other failure. 

2 2 3 

Same as above . 
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I 


i 


Description Failure Modes 


II. STEERING 

SUBSYSTEM 

FAILS 

II. A Guide cable is a 1. Cable broken 

GUIDE buried wire perraa- 

CABLE AND nently installed in 

EXCITER FAIL a saw cut in road 

pavement. A signal 
of a little less than 
10 KHz will be trans- 
mitted through cable by 
an exciter . 


Cable shorted 

3* Exciter outputs no 
signal 

4. Exciter outputs 
improperly (high 
signal, noise, 
etc.) 


5. Metal plate over 
guide cable 




Hazard Catalog 
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Description 


Failure Modes 


Failure Effects 


Risk Preliminary 

S P C Prevention or Remarks 


II. B PICK- 

Pickup sensor of 18 

1. One or more 

Summing amp when de- 

UP SENSOR 

side-by-side vertical- 

coils and/or 

tecting one signal 

fails 

axis coils location at 

associated cir- 

less will ignore 


same height above road 

cuits fail 

that missing signal. 


and at right angle to 


Vehicle will behave 


guide cable. These 


as if defective 


signals are shaped. 


channel is not there. 


pulse detected, and 


When failure occurs 


summed. Output of 


with large off center 


this sensor goes into 


bias (ie, several 


steering servo amp to 


coils failed from one 


command steering actu- 


side), vehicle will 


ator. There are two 


not be able to 


additional horizontal 


function properly 


coils Included as 


at a curve. 


reference signals. 

2. Pickup sensor 

Vehicle proceeds 



fails while 

ahead until acqui- 



centered 

sition signal ceases. 


332 * a) Loss of one channel will 

shift vehicle center off 
course by one inch. 
Acquisition signal will 
stop if cable lost. A 
possible dual (redun- 
dant) system will 
increase reliability. 

b) Periodic checkout per 
'written procedure needed 

to detect coil anomalies . 

c) Also, if failure of 
coils is enough to shift 
vehicle off axis far 
enough, scheduled stop 
sensor (buried magnet) 
would be missed and 
vehicle will miss its stop. 

323 Another failure required 

before hazard occurs. 


3. Pickup sensor 
fails When off 
center 


Vehicle turns 

4 2 3 

Serious problem . Needs 

suddenly before it 


independent accelerometer 

can be stopped 


input to limit lateral 



acceleration. 
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Description 

Failure Modes 

Failure Effects 

Risk 
S P C 

Preliminary 
Prevention or Remarks 

II. c 

StEERIHG 

ACTUATOR 

FAILS 

The steering servo amp 
accepts an input Vg 
(+5 Vdo) from the pick 
up sensor and drives the 
spool in the control 
valve to feed hydraulic 
pressure to the appro- 
priate side of the ac- 
tuator. Actuator will 
steer the wheels move- 
ment tracked and picked 
up via a feedback pot. 

1. Hydraulic steering 
servo amp input/out- 
put fail. 

Position of the feed- 
back pot not tracked , 
steering capability 
degraded or possible 
loss. Hydraulic con- 
trol valve not re- 
ceiving proper signal 
to operate steering 
actuator. 

3 2 2 

Redundancy needed. 



2. Feedback pot 
opens/shorts 

Will drive steering to 
one 3|imtt. 

^ 3 3 

Same as above. 



3* Hydraulic Control 
valve malfunctions 

Steering capability 
loss. Open winding 
will cause steering 
to drift to one limit. 

4 2 3 

Same as above. 

Rate of drift 
will depend upon 
mechanical zero 
adjustment of valve. 



4 . Hydraulic 

steering actuator 

Steering capability 
loss 

4 2 2 



malfunctions 
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Description Failure Modes 


II-D Supplying pressure to A failure in either the 

HYDRAULIC the hydraulic system motor or the pump, or 

MECHANISM are motor, pump, and a leak in the lines 

/ FAILS accumulator . 
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Risk 

Preliminary 

Description 

Failure Modes 

Failure Effects 

S P C 

Prevention or Remarks 


III. SPEED 
CONTROL 
SUflSySTEM 
FAILS 


III.A CON- Speed commands (slow, 

TROL LOGIC stop, start , etc .) 

FAILS will be combined to 

provide a set of 
ramp-shaped voltages 
which will direct the 
speed control servo 
either to activate 
SCR to a certain 
pulse rate or the 
brake logic to apply 
brake or reverse 
motor field (dynamic 
braking) . 


Inputs and outputs of 
many of the IC’s in the 
control logic could be 
shorted to ground , tied 
to power supply, open, 
or short . 


All input OR gates, 
except the passenger 
stop, will produce 
a logical 1 if an 
open circuit occurs 
between the gate 
and the sensor; ie, 
if a pri- head way 
sensor line opens 
up the logic will 
receive a slow com- 
mand . A short 
circuit would dis- 
able the signal 
input. 


423 To generate a corrective 
action for the control 
logic failure modes will 
require significant design 
effort . A convenient loca- 
tion to eliminate vehicle 
misbehavior is at the 
speed control, SCR, motor , 
tach loop. The addition 
of that comparator dis- 
cussed in I. A, I.C, and 
I.D will stop the vehicle 
regardless of command 
errors made in the proceed- 
ing stages. 
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Bisk Preliminary 

Description Failure Modes Failure Effects S P C Prevention or Remarks 


SPEED 
CONTROL 
SERVO AMP 
FAILS 


Speed control servo 
amp accepts command 
from the control logic 
and feedback from the 
control supplies the 
motor, Via SCR con- 
troller; power in the 
form of pulses. The 
rate Of these pulses 
determines the amount 
of powdr supplied. 


Last stage servo amp 
transistor C-E short 
will cause failure. 


Full power on will 3 

keep vehicle full 

speed ahead. When 

Vt>Vc vehicle would 

have full dynamic 

braking. 


2 Another coraparatrr is 

needed to compare 
output of speed ^^> 0 - 
trol servo amp with 
the input command to 
assure their consistency. 
This is similar to that 
mentioned in Section I. 
With full power limits 
might not be exceeded, 
but vehicle would not 
obey command. Therefore, 
the comparator above 
should be made to stop 
the vehicle and call 
for help. 
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Description 


Failure Modes 


III.G 

BRAKE 

LOGIC 

FAILS 


Brake logic accepts 1, Fails to receive 

command from control input command 

logic and signals v 

the brake actuator 

to apply the hydraulic 

brake or commands the 

SCR to reverse the 

motor current flow 

to apply dynamic 

braking . 

2 , Outputs to brake 
actuator or SCR con- 
troller malfunctions 
(opens, grounds, 
shorts) 


Hazard Catalog 


1 

— ^ ^ 5 

\ 

Risk Preliminary j 

Failure Effects S P C Prevention or Remarks j 


Commanded braking will 422 An investigation into using 

not result. Vehicle the input OR*s to provide 

could possibly be out some redundancy is needed, 

of control . The redundancy does not 

have to be two indentical 
paths , but rather dual 
signal lengths. 


Possible improper com- 4 22 Need further investigation 

mand transmission, to what happens if failure 

hence vehicle not occurs and how to correct 

functioning properly this deficiency, 

(predictably) , 
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Description 

Failure Modes 

Failure Effects 

Risk 
S P C 

Preliminary 
Prevention or Remarks 

III.D 

SCHEDULED 

STOP 

CONTROL 

FAILS 

Scheduled stop detec- 
tion is by means of 
sensing coil picking 
up signal from a 
buried permanent 
magnet. 

1 , A piece of metal 
laying over the 
buried magnet 

Magnet field will be 
interrupted and the . 
sensor will not pick 
up any signal. 

^23 

For future sophistication, 
have a build-in distance 
interpretation capability 
via a mileage reader and 
compare with a pre-programmed 
info. 



2. A piece of unplanned 
magnet on the ground 
surface 

Unplanned stop could 
be initiated hy this 
magnet. 

12 2 

a) Not safety related. 



3. Sensor fails off 

Scheduled stop will 
not be executed. 
Could possibly miss 
a stop sign. 

2 3 

a) System checkout procedure 
necessary. 

b) Redundant function 
needed for Intersection 
control as this is 
critical hazard. 



4. Sensor fails on 

Vehicle stops imraedi-^ 
ately; not a safety 
.concern. 

12 2 

Same as above. 
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Description Failure Modes 


■ ' IV * . 

HEADWAY 

; ; : SENSOR SUB- 

SYSTEM FAILS 

: iv\. A 

OPTICAL 

^ SENSORS FAIL 

I- ■ ■ ^ 

! 


3; Primary fails on. 


4- secondary fails on. 

5. Threshold drifts up 
or down. 


6. Aim error (from im- 
proper mounting or 
dislocating after 
mounting!. 


Designed sense obsta- 1 . Primary fails off. 

cles in time for a 
smooth stop. Primary 
and secondary sensor 
channels will provide 
distant (25ft) and 
close range (8ft) 
object detection re- 
spectively. The two 
sensor channels are 
pulsed at two differ- 
ent frequencies (IKH^ 
and l.OSKHz) and self 
compared when reflect- 
ed signal is received. 

GaAs LED and Si de- 
tector pairs are used 2. Secondary fails off. 

to detect the dif- 
fusely reflected light. 




Hazard Catalog 
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Description 


Failure Modes 


7. Blinded by direct 
sunlight. 


8. Blinded by approach- 
ing auto head lights. 

9« Interferred by sen- 
sors signals emitted 
from approaching 
AMTV. 

10. Insufficient headway 
sensing range for 
20raph (needs 125ft). 



n . Any of the optics 
like the lenses 
and the filters 
break, misalign, 
etc. 
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Risk 

Preliminary 

Description 

Failure Modes 

Failure Effects 

S P C 

Prevention or Remarks 


w 

1 

ro 

no 


IV*B The contact bumper con- 1 . Contact switches 

CONTACT sists of a horizontal fail inoperative 

BUMPER FAILS rod mounted on a sus- 

pended resilient semi- 
loop and two micro 
switches one on each 
side of the rod-to-loop 
contact. The contact 
bumper is 10 inches 
above the ground and 
extends 3 feet to the 
front of the vehicle. 

Any object in contact 
with the horizontal 
rod will activate one 
of the 2 micro switches 
and stop the vehicle 
immediately. 


Loss of optical 322 Modified the contact switch 

sensor backup installation such that each 

complement the other, instead 
each working independently 
of the other as they are now. 
The contact switches could 
be push-pull switches such 
that if one switch fails 
and the contact is made on 
that side, the pulling effect 
of the other side will act 
as the redundancy. 


2. Contact switches Vehicle will be 

fail on abruptly stopped. 


3 2 2 


3. The rod or the semi- The contact bumper 222 

loop or its mounting might be made in- 
break loose active or stop the 

vehicle . 


Routine checkout needed. 
Regular checkout and 
inspection could avoid 
this occurrence. 

Set up so that normal 
indication to proceed 
reouires continuity and 
bias power on. 
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Description 

Failure Modes 

Failure Effects 

Risk 
S P C 

Preliminary 
Prevention or Remarks 

V, 

ROUTE CONTROL 






V.A 

INTERSEC- 
TION SIGNAL 
INTERFACING 
FAILS 

The movement of the 
vehicle will be linked 
to the intersection 
signal lights such that 
safe passage is ensured. 
The four-way signals 
have all to be red 
when the vehicle is 
making a turn. 

1 . Signal path opens 

The signal light will 
not be able to receive 
a command, therefore 
might conflict with 
vehicle movement. 

H 2 2 

Besign the signal 
path such that an open 
Circuit will be alerted. 



2. Fails with erratic 
transraission 

The vehicle movement 
will not match signal 
light. 

M 2 3 

Further study is needed. 



3. Jams light on red 
or green 

Impede normal flow of 
traffic. Endanger 
vehicle movement when 
signal conflicts. 

n 3 3 

A detector can be installed 
to check that signal varies 
at least once during, say, 
one minute; otherwise a 
warning signal will be 
generated. 



4. Fails to make all 
lights red 

Endangers vehicle. 

M 3 2 

Further study is needed 
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Risk Preliminary 

Description Failure Modes Failure Effects S P C Prevention or Remarks 


V*B. When the vehicle ap- Fails to choose 

ROUTE SELEC- proaches a junction 

TION FAILS where route will split 

into two, the vehicle 
must possess the capa- 
bility to choose 2. Chooses the wrong 

which route to take. route 

This can be achieved Vi 

by either using dif- ' 

ferent cable frequen- 
cies or energize only 
one of the numerous 
cable to lead the ve- 
hicle toward that route* 


Vehicle must be made 43 2 Must avoid vehicle from 

to cease motion when taking the wrong route when 

failure to choose failure of choice occurs, 

occurs. 

Vehicle must be pre- 4 3 2 More work needs to be done, 

vented from taking There ought to be capabil- 

the wrong route ity for the central con- 

both for convenience trol to detect that a 

and safety reasons. vehicle is stuck at a cer- 

tain location. This capa- 
bility ought to be devel- 
oped and can be implemented 
with the localized signal 
Source concept such that 
when one location sends a 
vehicle to the next, it 
tells the center that it 
has done it and the center 
ought to anticipate its 
arrival at the location 
within a certain duration. 
Failure to receive a con- 
firmation of arrival from 
the next location will 
indicate that the vehicle 
is stuck between the two 
locations. 
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Description Failure Modes 


V.C Along the route, there 1 . Fails off 

ROUTE SPEED are stretches that the 

CONTROL vehicle travels at 

FAILS 20mph, Traph, 2mph 

(approaching scheduled 
stop), or fully 
stopped. The present 
design does not have 
all these capabil- 
ities j but vill have 
to be incorporated. 


2. Fails on 



ii 





Induced Hazard Catalog 


Failure Effects 

Risk 
S P C 

Preliininal'y 
Prevention or Remarks 

The vehicle will 

H 3 2 

More work is needed . 

continue to travel at 


Also see III.D scheduled 

the existing speed 
regardless of what 
the command signal 
says. 


stop failure . 

Vehicle will change 
to the next lower 
speed and proceed. 

13 2 

Not a safety concern. 


APPENDIX C 


ANALYTICAL MODELS OF AMTV 


This appendix discusses analytical models for: 

(1) Determining speed control parameters, including jerk, accel- 
eration, deceleration and speed profile, to satisfy stopping 
distance requirement and passenger safety/comfort requirement 

(2) Determining steering control parameters, including propor- 
tional constant, slew rate, and geometry of the guide-wire 
layout . 

(3) Analyzing vehicle/pedestrian interactions as they relate 
to system performance . 

(4) Defining schedules of vehicles and their headways for 
operational efficiency. 

All these models have been developed previously to analyze the 
operation of a 7-raph AMTV system. (Ref 17, 18). Major results from 
the previous analyses which have helped to clarify the AMTV operational 
characteristics and system requirements are summarized in this appendix. 
Also indicated is the possibility of extending these models for use in 
analyzing AMTV operations at higher speeds. In particular, this appendix 
presents in Figure C-1 a set of new curves that can help to determine 
the best deceleration and jerk rates for a 20-mph AMTV to stop safely and 
smoothly. 

A. VEHICLE MODELS 

1 . Speed Control Model 

Assume that an AMTV uses constant acceleration and decelera- 
tion rates with magnitude A ft/sec2, constant jerk rate at R ft/sec3, 
and maximum velocity V fps. The time-profile of acceleration or 
deceleration can be depicted as follows: 




The equations for stopping time and stopping distance have been 
derived before (Ref. 17) for two cases: 

(1) Stopping from maximum cruising speed V . 

The stopping time is 


Tl 


V A 
- + - sec 
A R 


The stopping distance is 

V2 AV 

Xi = — + — ft 
2A 2R 

(2) Worst-case stopping 

This happens when the vehicle is accelerating toward the ' 
maximum speed and the headway sensor detects an obstacle, 
it takes the braking system some time to change the vehicle 
from accelerating to decelerating, causing additional travel- 
ing before stopping. The stopping time in this worst case is 


T2 


V A 

- + 2 - sec 
A R 


The stopping distance is 
X2 


V2 AV A , A2, 

— + — + - (V - — ) ft 
2A 2R R 6R 


An important design question is the following: Given a prescribed 

distance (related to sensor range) within which a vehicle must be able 
to stop, what values must be selected for deceleration (A) and jerk 
(R) rates? 

The solutions for a 7-mph vehicle were given in Reference 17. 

It was shown that if the vehicle is to stop within 24 ft in the worst 
case, one should choose A = 5 fps2, R = 5 fps3. if the vehicle is to 
stop within 22 ft, it requires that A = 5 fps2, and R = 6.5 fps3. 

The solutions for a 20-mph vehicle are given in Figure C-1 . 

It can be seen that if the vehicle is required to stop within 130 ft 
in the worst case, A = 5 fps2 and R = 5 fps3 are good rates to choose. 


2. Steering Control Model 

A steering control simulation model was developed before (Ref. 18). 
The results of simulation indicated that steering angle should be propor- 
tional to the detected steering error. The proportionality constant 
and the steering slew rate for a 7-mph vehicle were determined according 
to the simulation results. The same techniques can be applied to the 
20-mph vehicle and obtain steering design parameters based on simulation 
results. 

B. SYSTEM OPERATION MODELS 

1. Vehicle/Pedestrian Interface Model 

This model was developed to study the effect of random pedestrian 
crossings upon the average operating velocity of a 7-mph AMTV (see Ref. 17) 
The results of simulation indicated that the average speed would be virtu- 
ally unaffected by pedestrians as long as encounter frequency is less than 
once every 8 seconds. The average speed would reduce to half of the 
cruising speed if the encounter frequency increases to once every 2 
or 3 seconds. 

The results also indicate that significant improvement of average 
speed can be achieved if pedestrians can be guided to yield the right of 
way to an AMTV upon encounter . 

needed for 20-mph operation because the vehicle 
would be moving on an exclusive semiguideway at any speed higher than 

7 mphi. " 

2. Scheduling model 

^ model was developed previously (see Ref. 17) to study 
the impact of random traffic disturbance and stochastic demand of passen- 
gers on the average passenger waiting time at tram stops. The simulations 
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Figure C-1 . Required deceleration (A) and jerk (R) rates 
to stop a 20 mph vehicle within prescribed 
distance in the worst case 



were conducted for 7-mph operation under various scheduling policies. 

The results have indicated the required frequency of tram dispatches 
that would keep passenger waiting time within some limits. Moreover, 
it was concluded that optimal scheduling policy depends on passenger 
demand. In low-demand hours, scheduling by clock or dispatching on 
demand should be adopted . In high-demand hours , vehicles should be 
dispatched as frequently as possible. In medium-demand hours, the 
frequency of vehicle dispatch should be correlated to the travel time 
of a vehicle needed to complete a loop. 

The same method can be used to study scheduling policies for 
any particular application. 

3. Headway Control Model 

The purpose of a headway control model is to help understand the 
effect of headway separations on system efficiency. A simulation model 
was previously developed (see Ref. 17) for a 7-mph AMTV system with 
one loop in the route. Headway control was exercised at a designated 
static':! on the loop by withholding an AMTV from leaving the station 
until a predetermined headway condition was satisfied. It was concluded 
that vehicles should be evenly distributed along the loop to prevent 
bunching that, on average , prolonged passenger waiting at tram stops. 

In high-demand hours, however, vehicles should not be withheld but 
should keep moving to achieve highest volume of circulation. 

The method can be used to study in detail headway policies for any 
application. 


